7 Recon Tricks Made Me Earn $$$ Bounty 通过被动枚举、生成子域名排列组合并验证存活子域名的方法发现隐藏的开发环境（如dev-admin.target.com），并提取带漏洞参数的URL进行分析。... 2025-5-11 02:41:20 | 阅读: 6 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com amass altdns subs httpx

$16,000 Bounty: Stored XSS in GitLab 安全研究人员发现GitLab存在Stored XSS漏洞，利用Markdown渲染中的正则表达式绕过CSP，在问题评论等处注入任意JavaScript代码。该漏洞被报告后获得$16,000赏金。... 2025-5-11 02:40:27 | 阅读: 24 | 收藏 | Bug Bounty in InfoSec Write-ups on Medium - infosecwriteups.com gitlab security rendering vakzz

$16,000 Bounty: Stored XSS in GitLab 安全研究员发现GitLab Markdown渲染引擎中的Stored XSS漏洞，利用DesignReferenceFilter正则表达式缺陷，在评论等处注入JavaScript代码并绕过CSP。该高危漏洞获GitLab $16,000赏金。... 2025-5-11 02:40:27 | 阅读: 6 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com gitlab security rendering

CSP? More Like Can’t Stop Payloads — Bypassing CSP to XSS Like a Pro 作者在测试子域名时意外发现了一个CSP绕过和XSS漏洞。通过使用subfinder、httpx等工具进行安全测试，最终发现了一个返回参数的端点，并成功利用该漏洞。... 2025-5-11 02:39:56 | 阅读: 5 | 收藏 | Bug Bounty in InfoSec Write-ups on Medium - infosecwriteups.com caffeine subs hoodie walked txthttpx

CSP? More Like Can’t Stop Payloads — Bypassing CSP to XSS Like a Pro 作者在周末进行子域名测试时意外发现XSS漏洞，并成功利用该漏洞解决了自己的咖啡瘾。... 2025-5-11 02:39:56 | 阅读: 4 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com subs hoodie caffeine stumbled ended

Tackling Conditional Blind SQLi Like a Pro: OSWE Prep Powered by Burp Suite 文章介绍了一种布尔型盲SQL注入攻击方法，通过利用HTTP响应中的“Welcome back”提示来推断数据库内容。攻击者通过构造条件语句向应用注入payload，根据响应的变化判断条件真假。具体步骤包括：确认漏洞存在、验证users表和administrator账户、确定密码长度及逐字符提取密码。文中还展示了如何使用Burp Suite和Python脚本自动化攻击过程。... 2025-5-9 14:31:37 | 阅读: 3 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com payload injection burp database intruder

Mastering Rate Limit Bypass Techniques 文章介绍了速率限制的作用及其常见实现方式，并探讨了黑客如何通过技术手段绕过这些保护措施以发起攻击。... 2025-5-9 14:20:30 | 阅读: 2 | 收藏 | Bug Bounty in InfoSec Write-ups on Medium - infosecwriteups.com limiting bypass attackers gaining undetected

Mastering Rate Limit Bypass Techniques 文章介绍了速率限制的作用及其常见实现方式，并探讨了黑客如何通过技术手段绕过这些保护措施以发起攻击。... 2025-5-9 14:20:30 | 阅读: 2 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com limiting bypass attackers toorate protections

UUIDs: A False Sense Of Security 2025-5-9 06:33:27 | 阅读: 3 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

$50,000 Bounty: GitHub Access Token 2025-5-9 06:33:18 | 阅读: 6 | 收藏 | Bug Bounty in InfoSec Write-ups on Medium - infosecwriteups.com

$50,000 Bounty: GitHub Access Token 2025-5-9 06:33:18 | 阅读: 3 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

️Recon Automation Like a Pro: My 5-Stage System to Catch More Bugs 2025-5-9 06:32:55 | 阅读: 4 | 收藏 | Bug Bounty in InfoSec Write-ups on Medium - infosecwriteups.com

️Recon Automation Like a Pro: My 5-Stage System to Catch More Bugs 2025-5-9 06:32:55 | 阅读: 4 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

Top 10 Ways Hackers Exploit Web Applications (and How to Prevent Them) 2025-5-9 06:25:48 | 阅读: 5 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

Open Redirect Vulnerability: What It Is and Why It Matters 2025-5-9 06:25:22 | 阅读: 3 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

Wazuh: The Free SIEM That Fights Like a Paid One 2025-5-9 06:25:14 | 阅读: 5 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

Unlimited Emails: A Bug That Let Me Spam Anyone =>$250 2025-5-9 06:24:8 | 阅读: 3 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

Bypassing Email Verification 2025-5-9 06:22:55 | 阅读: 3 | 收藏 | Bug Bounty in InfoSec Write-ups on Medium - infosecwriteups.com

Bypassing Email Verification 2025-5-9 06:22:55 | 阅读: 3 | 收藏 | InfoSec Write-ups - Medium - infosecwriteups.com

Exposed Session Tokens via Misconfigured Endpoint 2025-5-9 06:21:33 | 阅读: 2 | 收藏 | Bug Bounty in InfoSec Write-ups on Medium - infosecwriteups.com