The most useful posts in this topic, by likes from the community.
this is a writeup of a bug I reported to a SaaS billing vendor I am calling "Facturo" here (not the real name, the program is private and I am still under their disclosure terms). nothing in this post lets you attack them or anyone else. it is a plain IDOR, the oldest bug in the book, and the only reason it is interesting is the 94 days it took them to admit it. the setup Facturo is a billing dashboard that a few…
I get the same DM twice a week: "how do I get into hacking". so here is the answer once, properly, and I will just link this from now on. the mistake everyone makes is starting with tools. they install kali, run thirty programs they cannot read the output of, and give up in a month. you do not need kali to start. you need to understand how the web works, and then practise on things that are built to be broken. step…
Log4Shell (CVE-2021-44228, December 2021) is old news, but I keep seeing the same mistakes it should have cured, so here is the short version and what it was actually about. what happened Log4j is a Java logging library that is inside an enormous amount of the world's software. it had a feature where a logged string could trigger a lookup, and an attacker who could get a crafted string logged (a username, a user…
everyone remembers the XZ backdoor (CVE-2024-3094, March 2024) as "the thing that almost backdoored SSH on every Linux box". that part is true and it was caught by luck, a Microsoft engineer noticing a half second of latency. but if you only remember the clever technical part you learned the wrong lesson. here is the short technical shape of it, and this Seytonic video does the timeline well if you want the full…
Few people asked me after a chat discussion how I find where photo was taken. There is no magic and no secret software. It is mostly patience and writing down what you checked. Here is my real process, the same one I use for war footage, but please practice on your own city first. Not on people. Step 0: is it even new? Before geolocation, I check if the picture already exists online. Most "new" war photos I see in…
a short angry story, because I need to vent and because "informative" is the most insulting word in bug bounty. a company (private program, calling them "Shipr") had an image import feature. you give it a url, it fetches the image server side and stores it. classic SSRF territory. I pointed it at an internal address that only their own servers can reach, the kind of link to a cloud metadata service, and it happily…
every breach notification email: "we take your privacy seriously and there is no evidence your data was misused". translation: we were not looking, we still are not looking, and we found out from a journalist. the passive voice in these emails should be a CVE on its own
A reader asked how we decide whether a claimed strike location holds up. Here's the free toolkit and the actual decision rule. Nothing here needs a paid account. The free sources Sentinel-2 (ESA, optical): 10 m resolution in the visible bands, a new image roughly every 5 days at mid latitudes. Big burn scars, collapsed large buildings, craters in fields. Not cars, not people. Sentinel-1 (radar): sees through clouds…
