By IW Team — Jul 11, 2022

👩‍💻IW Weekly #15: Admin account takeover, IDOR broken authentication, CyberChef alternatives, Dark web access, etc.

Hey 👋

Welcome to the fifteenth edition of Infosec Weekly - the Monday newsletter that brings the best in Infosec straight to your inbox.

In today’s edition, we’ve curated all the amazing Infosec stuff that needs your attention this week in a format of 5 articles, 4 Threads, 3 videos, 2 Github repos and tools, and 1 job alert and Upcoming CTF Events to help you maximize the benefit from this newsletter and take a massive jump ahead in your career.

Excited? Let’s dive in👇

📝 5 Infosec Articles

#1 Check out this detailed article on how @Mahmoud Youssef did admin account takeover via weird Password Reset Functionality.

#2 A complete detailed guide on IDOR - Broken Authentication by @Shay Rand to give you a complete idea for “How to Think and Test” for the same.

#3 @Frans Rosén did a great research on how there still exist numerous methods to steal certain leaked tokens from sign in OAuth-flows. Read about his research here:- Account hijacking using ”dirty dancing” in sign-in OAuth-flows

#4 Do you hunt on old programs? If not, read about how @Zunaid Mehmud was able to find an interesting privilege escalation vulnerability in an old private program.

#5 An Interesting bug chaining leads to PII Disclosure of Apple Users($10k) and how @Ahmad Halabi was able to bypass the Fix by the program.

#1 Ever wondered about good CyberChef tool alternatives? @Matt’s short thread of solid CyberChef alternatives and complementary tools has something for you.

#2 Preparing to work on your source code review skills from the beginning? @Ananda Dhakal’s twitter thread: A thread- Resources for Source Code Review will be a great help for you.

#3 What do you do when a program has a scope like a site.* (es|com|cn...) ? @Philip Delteil shares his take on such a scenario with an informative twitter thread.

#4 @InsiderPhD drops an awesome API mind map in #bugbountytips hashtag to help you get an idea if you are planning to learn about it.
What is an API? What makes them special? And what kind of APIs are out there?

📽️ 3 Insightful Videos

#1 Ever thought about accessing the Dark Web and exploring its secrets and conspiracies? Heath Adams aka @TheCyberMentor uploaded a great video on How to Access the Dark Web Safely in 2022.

#2 Watch this great video interview by @MastersinIT1 on youtube to know more about the The Real World Of Cyber Security | Cyber Security talk with Sainath Volam.

#3 Want to learn Json WebTokens and solve labs with @0xTib3rius?Check out this video by him, Learn and solve labs for JWT:- Web App Wednesday (6/22/22) - Portswigger JWT Labs.

⚒️2 Github repositories & Tools

#1 A well organized github repository with bugbounty write-ups collection sectioned as Owasp top 10 vulnerabilities.

#2 Koh is a C# and a Beacon Object File (BOF) toolset that allows for the capture of user credential material via purposeful token/logon session leakage.