Bug Bytes #204 – Everything You Missed From NahamCon
Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.
This issue covers the week from June 12th to June 18th
Intigriti News
From my notebook
So this week and weekend saw the return of NahamCon and there were some great talks on the main programme and the villages on Saturday, the talks are still being uploaded so we’ll update you when they’re all available but here’s what’s been released so far…
#NahamCon2023: Bug Bounty Village | Free Workshops | !discord
Going Beyond Microsoft IIS Short File Name Disclosure – NahamCon 2023 Edition
Nahamcon [The Power of Shodan Leveraging Shodan for Critical Vulnerabilities]
How to do account takeover? Case study of 146 bug bounty reports
Autorize in 30 Seconds! (shorts)
Genymotion – Proxying Android App Traffic Through Burp Suite | Cameron Cartier
given up on random text files, all my notes are now in burp tab titles
I continually underestimate how beneficial it is to go for scope that others avoid.
Beginner
Intermediate
Advanced
Security Research
From Bug Bounty Hunter to Risk Analyst: My Cybersecurity Journey at Deloitte
Pentesting Xamarin Android apps: DLLs and root check bypass – hn security
can I speak to your manager? hacking root EPP servers to take control of zones
MOVEit Transfer CVE-2023-34362 Deep Dive and Indicators of Compromise
Pre-Authenticated RCE In VMware VRealize Network Insight CVE-2023-20887
Bugs
CTF challenges
Unveiling Trickest: My Secret Weapon for Automating the Bug Bounty Hunt
Capture Login Information from the Captive Portal with SEToolkit
GitHub – Anof-cyber/MobSecco: Clone Cordova application for bypassing security restrictions
Get a list of associated domains from a list of IPs with hakip2host!
Find leaked API Keys and Secrets using a single GitHub search query
This bypass by @Akamai *may* be useful when exploiting Windows-based SSRF vulnerabilities
trick to find hidden endpoints on web apps, start with Underscore (_)
You may also like
September 25, 2026
Intigriti Bug Bytes #240 - September 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Compromising OpenAI, Slack, Meta, and more via a vulnerable image library Hacking OpenAI employee accounts in under 72 hours Breaking into Google's GFile for $100K Hacking AI CX agents Turbo Intruder 2 surpassing
August 28, 2026
Intigriti Bug Bytes #239 - August 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we are featuring: Intigriti as the new provider for Adobe's Bug Bounty Program CSS injection as an attack vector inside your email inbox AI doing novel security research: the HTTP Terminator 169 offensive recon skills in one AI-ready
July 31, 2026
Intigriti Bug Bytes #238 - July 2026 🚀
Welcome to the latest edition of Bug Bytes! In this month's issue, we'll be featuring: Intigriti turns 10! RCE in GitHub.com and GitHub Enterprise Server Burp Suite going agentic with Burp AT Hacking Gemini Enterprise for $15,000 3,708 live credentials found by scanning GitHub Archive And so much mo