Archive

[HackerNotes Ep. 76] Match & Replace - HTTP Proxies' Most Underrated Feature

[HackerNotes Ep. 76] Match & Replace - HTTP Proxies' Most Underrated Feature

HackerNotes is back with some tasty exploit writeups, HackerOne AWC news and some match & replace tips for your next bug hunt.

gr3pme
gr3pme
[HackerNotes Ep. 74] Supply Chain Attack Primer - Popping RCE Without an HTTP Request

[HackerNotes Ep. 74] Supply Chain Attack Primer - Popping RCE Without an HTTP Request

Check out all things supply chain and dependency confusion below.

gr3pme
gr3pme
[HackerNotes Ep. 73] Sandboxed IFrames and WAF Bypasses

[HackerNotes Ep. 73] Sandboxed IFrames and WAF Bypasses

Content from NahamCon, WAF Bypasses, iFrame research and more!

gr3pme
gr3pme
[HackerNotes Ep. 72] Research TLDRs & Smuggling Payloads in Well Known Data Types

[HackerNotes Ep. 72] Research TLDRs & Smuggling Payloads in Well Known Data Types

Justin and Joel discuss some hot research from the past couple months. This includes ways to smuggle payloads in phone numbers and IPv6 Addresses, the NextJS SSRF, the PDF.JS PoC drop, and a GitHub Enterprise Indirect Method Information bug. Also, we have an attack vector featured from Monke!

gr3pme
gr3pme
[HackerNotes Ep. 71] More VDP Chats & AI Bias Bounty Strats with Keith Hoodlet

[HackerNotes Ep. 71] More VDP Chats & AI Bias Bounty Strats with Keith Hoodlet

Keith Hoodlet joins the guys to weigh in on the VDP Debate, followed by AI bias bounties and some of the techniques he used to claim first place in the recent DoD AI bug bounty program.

gr3pme
gr3pme
[HackerNotes Ep. 70]: NahamCon and CSP Bypasses Everywhere

[HackerNotes Ep. 70]: NahamCon and CSP Bypasses Everywhere

Metas' bug bounty program, NahamCon, CI/CD security and CSP bypasses.

gr3pme
gr3pme
[HackerNotes Ep. 69]: Johan Carlsson - 3 Month Check-in on Full-time Bug Bounty.

[HackerNotes Ep. 69]: Johan Carlsson - 3 Month Check-in on Full-time Bug Bounty.

CSP Bypasses in GitHub, GitLab Pipeline Criticals, Tips for Full-Time Bug Bounty, and a Browser Behavior Gadget with Johan Carls

gr3pme
gr3pme
[HackerNotes Ep. 68]: 0-days & HTMX-SS with Mathias

[HackerNotes Ep. 68]: 0-days & HTMX-SS with Mathias

Mathias is back with some fresh HTMX research, including CSP bypass using HTMX triggers, converting client-side response header injection to XSS, and bypassing HTMX disable. Some cool behaviour in Cloudflares image optimization functionality is also dropped to achieve partial open redirect.

gr3pme
gr3pme
[HackerNotes Ep. 67] VDPs & Accidental Program VS Hacker Debate Part 2

[HackerNotes Ep. 67] VDPs & Accidental Program VS Hacker Debate Part 2

The guys deep-dive on the topic of Vulnerability Disclosure Programs (VDPs) and whether they are beneficial or not. We also touch on the topic of leaderboard accuracy, and some methods of bypassing endpoints which have been restricted by WAFs or reverse proxies.

gr3pme
gr3pme
[HackerNotes Ep. 66] CDN-CGI Research, Intent To Ship, and Louis Vuitton

[HackerNotes Ep. 66] CDN-CGI Research, Intent To Ship, and Louis Vuitton

The guys cover the YesWeHack Louis Vuitton LHE, browser market shares and browser behaviours, OAuth redirect_uri bypasses, documented bug bounty journeys and Googles intent to ship features.

gr3pme
gr3pme
[HackerNotes Ep. 65] Motivation and Methodology with Sam Curry (Zlz)

[HackerNotes Ep. 65] Motivation and Methodology with Sam Curry (Zlz)

The guys sit down with Sam Curry to discuss the ethical boundaries of research, his methdology and approach to his research, and a bunch of other cool bugs he's found.

[HackerNotes Ep. 64] .NET Remoting, CDN Attack Surface, and Recon vs Main App

[HackerNotes Ep. 64] .NET Remoting, CDN Attack Surface, and Recon vs Main App

Exploiting .NET Remoting, Dom Purify Bypass, JS Deobfuscation, Delivering Impactful POCs, and Cloudflares CDN-CGI: Insights from Justin and Joel

gr3pme
gr3pme
FirstBack
1234
Next Last