Bug Bytes #138 – Web app security roadmap, OWASP Top 10 & Request smuggling via integer overflow
By Anna Hammond
September 15, 2021
Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the week from September 6 to 13.
Intigriti news
Atos and Intigriti launch new integrated Bug Bounty service
Our favorite 5 hacking items
1. Resource of the week
Web Application Security Roadmap
The number of resources for hackers and skills to learn can be intimidating. This roadmap created by @HolyBugx compiles interesting resources and books for all levels. Most importantly, they are divided into tiers which helps choose what to focus on without getting overwhelmed.
2. Writeups of the week
Critical Vulnerability in HAProxy (CVE-2021-40346): Integer Overflow Enables HTTP Smuggling
Hacking CloudKit – How I accidentally deleted your Apple Shortcuts (Apple, $64,000)
Finding Azurescape – Cross-Account Container Takeover in Azure Container Instances (Microsoft)
GitHub Actions check-spelling community workflow – GITHUB_TOKEN leakage via advice.txt symlink (GitHub)
The first writeup is about an integer overflow in HAProxy that was exploited to enable request smuggling. An interesting crossover of different types of vulnerabilities.
The second writeup is @fransrosen‘s story of hacking Apple, which clarifies why Apple shortcuts broke back in March…
Next is a writeup on Azure Container Instances. @yuval_avrahami found a cross-account container takeover that could’ve allowed a malicious Azure user to attack other customers.
Another interesting finding is a vulnerability in GitHub Actions. @justinsteven found a way to leak GITHUB_TOKEN API keys and introduce malicious code to Microsoft, NASA, PowerDNS and Jekyll repos.
3. Vulnerability of the week
CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability
CVE-2021-40444 is an RCE in Microsoft MSHTML (the Internet Explorer browser engine). It is triggered simply by opening a malicious Microsoft Office document (without macros) and was discovered as a a zero-day actually being exploited in the wild.
Here are a few resources if you want to know more:
4. Non technical item of the week
Obsidian, Taming A Collective Consciousness
This is an excellent post on the knowledge management system used by TrustedSec’s red team. The article details how they leverage Obsidian and the Zettelkasten method for efficient note-taking as a team.
5. Article of the week
Introduction to OWASP Top 10 2021 & Intigriti’s insights on it
The draft OWASP Top 10 2021 is out. Among other changes, injection lost its first place for the first time since 2007 and SSRF made it to the list. Also, some vulnerabilities were included in broader categories, for instance XSS is now in the “Injection” category, XXE in “Security Misconfiguration”, etc.
Other amazing things we stumbled upon this week
Videos
0day Shares His Journey on Becoming #1 on TryHackMe, Learning How to Hack, Resources and more!
LiveStream – Avinash Jain – Journey To Security Engineer @Microsoft
“Automation Is Going To Play Huge Role” with @kapytein (Hacker Heroes #13)
How to learn anything in Computer Science or Cybersecurity | Security Simplified
Podcasts
Radio Hack Ep5: Bug Bounty & Triaging – Ebrahem Hegazy (In Arabic)
Reused VMWare exploits & Escaping Azure Container Instances [Bug Bounty Podcast]
The Mēris Botnet – 0-Day Attack on Office Docs, WFH and Security, Return of REvil
Webinars
Hacker School Reboot – insights from leading API hackers [VIDEO]
BHIS | Getting Started in Blockchain Security and Smart Contract Auditing | Beau Bullock & Slides
Conferences
Tutorials
Medium to advanced
Offensive WMI – The Basics (Part 1), Exploring Namespaces, Classes & Methods (Part 2) & Interacting with Windows Registry (Part 3)
Beginners corner
Writeups
Challenge writeups
Obfuscated Password Manager?! Solution to September ’21 XSS Challenge
CSRF – Lab #2 CSRF where token validation depends on request method
Pentest writeups
Responsible(ish) disclosure writeups
Bug bounty writeups
Bug Bounty Guest Post: Local File Read via Stored XSS in The Opera Browser (Opera, $4,000)
Bypassing GCP Org Policy with Custom Metadata & GCP AI Notebooks Vulnerability – Remediation (Google, $1,337)
See more writeups on The list of bug bounty writeups.
Tools
cspp-tools: Client-Side Prototype Pollution Tools
Apkeep: CLI for downloading APK files from various sources
Lazydroid: Bash script to facilitate some aspects of an Android application assessment
gcpHound: A Swiss Army Knife Offensive Toolkit for Google Cloud Platform (GCP)
htmlq: Like jq, but for HTML
WWWGrep: A rapid search “grepping” mechanism that examines HTML elements by type
Tips & Tweets
Leaking source code or auth bypass using alternate data streams
Did you know that ssh tries to authenticate with stored keys BEFORE the key specified with -i?
Misc. pentest & bug bounty resources
Fresh-Resolvers: List of Hourly Updated Fresh DNS resolvers
Challenges
Articles
Google Cloud Build — under the hood (Google)
Bug bounty & Pentest news
Bug bounty
Upcoming events
h@cktivitycon 2021 (September 18) & H@cktivityCon 2021 CTF (September 16-18)
Tool updates
Non technical
You may also like
Intigriti Bug Bytes #220 - January 2025 🚀
January 10, 2025
Intigriti Bug Bytes #219 - December 2024 🎅
December 13, 2024
Bug Bytes #218 – Advent of Cyber, RCEs and hacking poems
December 6, 2023