Home Classic Look

Introducing SignSaboteur: forge signed web tokens with ease

Signed web tokens are widely used for stateless authentication and authorization throughout the web. The most popular format is JSON Web Tokens (JWT) which we’ve already covered in depth, but beyon...

May 22, 2024 web

👩‍💻IW Weekly #111: SSRF in NextJS, Blind SSRF on WordPress, ChatGPT Rate Limit Bypass, IDOR at Swiggy and many more...

Welcome to the #IWWeekly111 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Item...

May 20, 2024 newsletter, ssrf, idor, bypass

Reconfigurable CORS middleware with jub0bs/cors

TL;DR ¶ In this short follow-up to my previous post, I describe why and how I’ve added support for dynamic reconfiguration of CORS middleware in jub0bs/cors. Rethinking configuration immutability ¶...

May 14, 2024

👩‍💻IW Weekly #110: GitHub Actions Cache Poisoning, CVE-2024-0200, Relative Path File Injection, Hacking Apple, Hacking Microsoft's AI bot and many more…

Welcome to the #IWWeekly110 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Item...

May 13, 2024 newsletter, cve, cache, app, github, microsoft, apple

👩‍💻IW Weekly #109: Hacking Telegram, Raining IDORs and BACs, Microsoft Graph Logging Bypass, HTMX Bugs, Wordlist for CI/CD Hacking and many more…

Welcome to the #IWWeekly109 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Item...

May 6, 2024 newsletter, idor, bypass, microsoft

👩‍💻IW Weekly #108: PostMessage for XSS, Smart Contract Security, Admin Panel Takeover, DOM-XSS to ATO, Process Injection With C, Privilege Escalation and many more …

Welcome to the #IWWeekly108 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Ite...

Apr 29, 2024 newsletter, xss, takeover, security

jub0bs/cors: a better CORS middleware library for Go

TL;DR ¶ I’ve just released jub0bs/cors, a new CORS middleware library for Go, perhaps the best one yet. It has some advantages over the more popular rs/cors library, including a simpler API, better...

Apr 27, 2024

👩‍💻IW Weekly #107: CVE-2024-0333, $50,000 for hacking Google A.I, Auth-Bypass via Response Tampering, HTTP Request smuggling case study, Telegram RCE and many more…

Welcome to the #IWWeekly107 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Ite...

Apr 22, 2024 newsletter, cve, rce, auth, bypass, google

4 bug bounty mistakes and how to avoid them

Getting into bug bounties is no easy task, we know. There’s so much to consider and your path to becoming a bug bounty hunter can vary in so many ways. Bug bounty hunting can be fraught with challe...

Apr 17, 2024 bounty

👩‍💻IW Weekly #106: Hacking ICON Blockchain, BatBadBut Vulnerability, DOM XSS to ATO, Starbucks Hack, Bypassing Phone Number Verification and many more…

Welcome to the #IWWeekly106 - the Monday newsletter that brings the best in Infosec straight to your inbox. To help you out, we have 5 Articles, 4 Threads, 3 Videos, 2 Job Alerts and a Special Item...

Apr 15, 2024 newsletter, xss, bypass

1
...
9
10
11
...
34
10 / 34