Bash scripting is an easy concept that can allow bug bounty hunters to automate repetitive tasks and spend more time on advanced vulnerabilities, often resulting in higher payouts.

Tool chaining is just that, using Bash scripting to integrate multiple tools executed in a predefined pattern. This post discusses the use of tool chaining in bug bounty automation and introduces a new enumeration tool to add in your recon process!

Introduction

Automation is the latest trend in bug bounty hunting, with new frameworks being released every day. This ranges from full-fledged solutions with user interfaces and back-end databases to collections of custom-built…

Whether your writing a professional report or your next Medium story, trying to convey technical subjects to your audience is no easy task. A clear focus and concise formatting can easily get lost in required pretext or lengthy code blocks.

As a cybersecurity consultant, interpreting complex tasks and making sense of various computer languages comes part of the job. However, it can be challenging to transcribe these subjects into fully comprehensible reports. While I am far from calling myself an expert, I have found 5 tips to consider that have helped me improve my technical writing.

1. Define your target audience

The first step to…

Maintaining the code base on your own personal blog or website can be a great learning experience. It teaches you about the design and architectural decisions involved in running a successful site, and allows for added flexibility outside of otherwise preset behaviors.

Additionally, this approach makes you less reliant on a single framework or platform. Should you need to move hosting providers, simply copy your files into another cpanel or web directory.

Despite these benefits however, there is a steep learning curve to maintaining your own site — beyond the notable coding knowledge required. For example, minor changes to a…

What does it mean to be “PCI” compliant?

If you own a business or work in the industry, you’ve most likely heard of PCI and know maintaining compliance is critical for a business to continue accepting credit card payments.

For the rest of us however, “PCI” is an even shortened version of the acronym “PCI DSS”, which stands for Payment Card Industry Data Security Standard. This is a set of standards released by the PCI Security Standards Council that provide technical and operational baselines an organization must meet in order to handle credit card information. In other words, any organization processing credit card data needs to be compliant…

Have you ever installed a Python application, only to find out later the required dependencies replaced those of another critical application?

Python virtual environments can help eliminate this dependency nightmare and make the installation and management of your projects more sustainable. This post will review the concept of virtual environments and introduce three tools for applying safer dependency management practices.

What are Virtual Environments in Python?

Python virtual environments are isolated spaces that allow programs to run separate from the shared, system-wide installation. These environments are created in self-contained folders that consists of all required binaries for execution. …

Okay, so Slack can’t actually perform port scans! However, it can act as a communication channel to relay tasks, such as port scanning, to a remote server.

This post demonstrates how to use Slack to automate repetitive, resource intensive tasks during bug bounty hunting or any offensive security engagement. This comes with multiple benefits and ultimately frees up your primary host to continue testing until results are returned.

Introduction

Port scanning is an essential step in the recon process that can lead to missed opportunities if left unchecked. …

LinkedIn is the world’s largest professional networking platform and used every day for recruiting, marketing, and connecting. However, it’s because of this that LinkedIn is also a great source for information gathering during penetration testing.

Through a company’s profile, it’s possible to collect a list of current employees and their position. This information can lead to spear phishing, password spraying, or other attacks against the organization. While there are various opensource tools to help collect and weaponize this information, I have always found one reason or anther to perform this process manually.

Until now…

Introducing CrossLinked

CrossLinked was created to simplify the…

Metadata is simply defined as data about data. In computer systems, this is used to correctly interpret files and store descriptive attributes. While not always visible, metadata provides far more information than content creators realize. Once a document and containing metadata is made public, it could unknowingly help an attacker infiltrate your organization.

As a penetration tester, I am often given a week to target a client’s public facing environment with the goal of breaching their internal network. This form of testing allows the client to evaluate the effectiveness of their defensive solutions, assess the security team’s response to simulated…