Bug Bytes #179 – Hacking Farms, Pwning Calendars & Hacker drones?
By travisintigriti
October 26, 2022
Last updated on August 8, 2026
Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the weeks from October 16th until October 22nd.
Intigriti News
From my notebook
DEF CON 30 – Eugene Lim- You Have 1 New Appwntment – Hacking Proprietary iCalendar Properties & DEF CON 30 – Sick Codes – Hacking the Farm = Breaking Badly into Agricultural Devices If I had to pick the two stand out talks for me at DEFCON this year these are the two that I think about weekly since the summer, and also I actually used some of the tips in the ical video to find a bug! My tip for you reading is to check if apps automatically scan emails or similar to make calendar events.
Broken Access Control testing by ShreKy & Google VRP — [Insecure Direct Object Reference] $3133.70
How I Got $10,000 From GitHub For Bypassing Filtration oF HTML tags
23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite
Other Amazing Things
DEFCON Releases videos from DEFCON 30 August 2022 – here’s just a small selection that interested me
DEF CON 30 BiC Village – Ochuan Marshall – The Last Log4J Talk You Ever Need
DEF CON 30 – James Kettle – Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
DEF CON 30 – Orange Tsai – Let’s Dance in the Cache – Destabilizing Hash Table on Microsoft IIS
DEF CON 30 – Michael Bargury – Low Code High Risk – Enterprise Donation via Low Code Abuse
DEF CON 30 – Jeffrey Hofmann – PreAuth RCE Chains on an MDM – KACE SMA
DEF CON 30 – Samuel Erb, Justin Gardner – Crossing the KASM – a Webapp Pentest Story
DEF CON 30 – Thomas Roth , Solana – JIT – Lessons from fuzzing a smart contract compiler
DEF CON 30 – Richard Thieme – UFOs, Alien Life, and the Least Untruthful Things I Can Say
DEF CON 30 – stacksmashing – The Hitchhacker’s Guide to iPhone Lightning and JTAG Hacking
DEF CON 30 Retail Hacking Village – Spicy Wasabi – Rock The Cash Box
CYBER When the Video Game Reaches Out to Ask You to Spend More Money
Smashing Security 294: The Virgin trains swindler, cyber clowns, and AirTag election debacle
PHP filters chain: What is it and how to use it (deserialisation)
Practical Guide to Malware Analysis and Reverse Engineering(Analyzing VBA“Macros” Code P-2.2)
Burp Suite? No Thanks! Blind SQLi in DVWA With Python (Part 1)
OTP in forget password | how to bypass OTP verification | OTP poc
“Zero-Days” Without Incident – Compromising Angular via Expired npm Publisher Email Domains
I found a bug that would let me fetch any users password reset link
GitHub – Crypto-Cat/CTF: CTF chall write-ups, files, scripts etc (trying to be more organised LOL)
Extract e-mail addresses from a large JSON file – Zero Day Hacker
Paranoids (Yahoo) promotions until the end of the year
First 75 hackers of the month between October and the end of the year get a 25% bonus
First 10 mobile app reports 50% bonus
Submit a nuclei template for a 10% bonus
Welcome back bonus coming soon
Login spoofing issue in GitHub nets researcher $10k bug bounty reward
Dangerous hole in Apache Commons Text – like Log4Shell all over again
You may also like
July 31, 2026
Intigriti Bug Bytes #238 - July 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Intigriti turns 10! RCE in GitHub.com and GitHub Enterprise Server Burp Suite going agentic with Burp AT Hacking Gemini Enterprise for $15,000 3,708 live credentials found by scanning GitHub Archive And so much mo
June 26, 2026
Intigriti Bug Bytes #237 - June 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: A 10-year-old pre-auth RCE in phpBB Earning $500K hacking Google with AI Reading any Salesforce Marketing Cloud account's emails New DOMPurify sanitizer bypass Mapping abandoned S3 buckets to redo SolarWinds at scal
May 30, 2026
Intigriti Bug Bytes #236 - May 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Earning $148K via RCE in Google Cloud How public Google API keys became Gemini credentials Our first official Burp Suite extension Two new bypasses for Chrome's Sanitizer API One-click account takeover from a sani