Pentester world 2.0

CVE-2023-4473 & CVE-2023-4474 - Authentication bypass and multiple blind OS command injection vulnerabilities in Zyxel’s NAS326 devices https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/

Cybersecurity Certifications for Beginners https://www.youtube.com/watch?v=Mqo7-k5jcJQ

How To Hack APIs with Python https://www.youtube.com/watch?v=NIceKjhZhrI

Introducing Fuzzomatic: Using AI to Automatically Fuzz Rust Projects from Scratch https://research.kudelskisecurity.com/2023/12/07/introducing-fuzzomatic-using-ai-to-automatically-fuzz-rust-projects-from-scratch/

GitHub - rootcathacking/catspin: Catspin rotates the IP address of HTTP requests making IP based blocks or slowdown measures ineffective. It is based on AWS API Gateway and deployed via AWS Cloudformation. https://github.com/rootcathacking/catspin

How to debug Android native libraries using JEB decompiler https://medium.com/@shubhamsonani/how-to-debug-android-native-libraries-using-jeb-decompiler-eec681a22cf3

Writing Custom Malware: Import Address Table Hooking https://www.youtube.com/watch?v=g4RaCFXUqhQ

Legit Discovers "AI Jacking" Vulnerability in Popular Hugging Face AI Platform https://www.legitsecurity.com/blog/tens-of-thousands-of-developers-were-potentially-impacted-by-the-hugging-face-aijacking-attack

Awesome Bug Bounty Tools- Exploring Subdomain Enumeration and Reconnaissance Tools https://cyberconqueror.medium.com/awesome-bug-bounty-tools-exploring-subdomain-enumeration-and-reconnaissance-tools-7bffb25210e6

Digital Forensics with FTK Imager (TryHackMe Advent of Cyber Day 8) https://www.youtube.com/watch?v=7wB0HNf1qh4

New payload to exploit Error-based SQL injection  - Oracle database https://www.mannulinux.org/2023/12/New-payload-to-exploit-Error-based-SQL-injection-Oracle-database.html

Reflected XSS bypassing hidden input tag and auto-submit script in a form https://hackcommander.github.io/bug-bounty-8/

New payload to exploit Error-based SQL injection  - Oracle database https://www.mannulinux.org/2023/12/New-payload-to-exploit-Error-based-SQL-injection-Oracle-database.html

2024 Live Hacking Events https://www.hackerone.com/lhe/2024-lhe-invitations

Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix https://www.ambionics.io/blog/wrapwrap-php-filters-suffix

HackerOne disclosed on HackerOne: Server Side Request Forgery... https://hackerone.com/reports/2262382

Reflected XSS bypassing hidden input tag and auto-submit script in a form https://hackcommander.github.io/bug-bounty-8/

CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution https://blog.projectdiscovery.io/crushftp-rce/

Limit Overrun Race Conditions https://www.youtube.com/watch?v=ci5_VmDNAo0

Silverpeas App: Multiple CVEs leading to File Read on Server - Rhino Security Labs https://rhinosecuritylabs.com/research/silverpeas-file-read-cves/