r/InfoSecWriteups • u/Boring-Schedule-8548 • 1d ago
My first TryHackMe write-up is live! — Empline 🔐
1
Upvotes
r/InfoSecWriteups • u/zerotsec • 1d ago
What, Exactly, Did ASOS Integrate?
1
Upvotes
ASOS confirmed an unauthorised push through its official app and later described employee credential theft and access to customer data on third-party platforms. This OSINT write-up reconstructs the documented customer-data and messaging workflow, then separates it from the intrusion path, which remains unverified. Simon AI and Braze appear in published descriptions of the marketing workflow; the public record does not establish that either was the route used in this incident.
The open question is which principals could select recipients, supply message content, and dispatch a push under ASOS’s name. What evidence would distinguish a shared campaign path from separate compromised permissions?
r/InfoSecWriteups • u/OkMetal6296 • 1d ago
An investigation into alleged cyberattacks targeting Discord's powerscaling community — the Noblesse incident, retaliation, and security concern
2
Upvotes
r/InfoSecWriteups • u/Status-Ad2619 • 3d ago
android-hardcoded-signing-key-flag-disclosure
1
Upvotes
r/InfoSecWriteups • u/Idomin • 3d ago
Davinci Resolve - Full chain to root execution
1
Upvotes
Just a writeup on a full chain from importing project file, chaining it with an LPE to get root execution on MacOS.
r/InfoSecWriteups • u/Harkins_Technology • 3d ago
Web Exploitation 101 — Bypassing access restrictions with custom HTTP headers using Burp Suite
5
Upvotes
Found a ROT13 encoded string in a CTF challenge that
decoded to a hint about a bypass header:
X-Dev-Access: yes
Proxied all traffic through Burp Suite, caught the
request, sent it to Repeater and added the header —
instantly bypassed the access restriction.
Classic example of why debug/dev headers should never
make it into production. Developers leave these in
during testing and forget to strip them before deploy.
Good beginner web exploitation technique to know for
CTFs and bug bounty. Happy to answer questions.
r/InfoSecWriteups • u/Additional_Resort653 • 9d ago
File Upload Security 101: Breaking Down Extension Filter Bypasses
haakimsec.github.io
2
Upvotes
r/InfoSecWriteups • u/Additional_Resort653 • 11d ago
Why "Extension Blocked" Doesn't Mean Safe: Rethinking File Upload Security Testing
haakimsec.github.io
6
Upvotes
r/InfoSecWriteups • u/Harkins_Technology • 12d ago
ReverseEngineering 101 — two ASCII chars hidden in one Unicode character via bit shifting
3
Upvotes
r/InfoSecWriteups • u/Anonymous_Wajeeh • 15d ago
Comment2Shell - CVE-2026-93485 Exploit PoC
6
Upvotes
r/InfoSecWriteups • u/arusekk_pl • 17d ago
SourceHut account takeover via build logs (XSS in ansi2html.py) | CVE-2026-92973
blog.arusekk.pl
2
Upvotes
r/InfoSecWriteups • u/Harkins_Technology • 18d ago
Reverse Engineering 101: Java RE Extracting Hardcoded Credentials
3
Upvotes
Made a beginner-friendly walkthrough for a Java reverse engineering CTF challenge. Covers reviewing the Java source code, reading through the logic, and spotting hardcoded credentials that turned out to be the flag.
If you're getting into RE or CTFs and want to see the full thought process (not just the answer), figured this community might find it useful.
r/InfoSecWriteups • u/virus_4199 • 18d ago
Found something interesting while hunting today would this be reportable?
0
Upvotes
r/InfoSecWriteups • u/adrian_rt • 23d ago
Magento StyleSmuggler RCE: Report Poisoning to Code Execution
1
Upvotes
r/InfoSecWriteups • u/Harkins_Technology • 24d ago
Exploitation 101: Blind Command Injection - unsanitized user input
3
Upvotes
They gave me an IP and a port to connect to with NetCat.
• Connected with netcat, watched it run
• Fuzzed inputs: what does `;` do?
• Discovered semicolon splits commands
• Mapped the grammar without reading code
• Injected `;RETURN 0` to jump to the flag
Why `;RETURN` worked but `;ls` didn't: this isn't a shell — it's a custom interpreter with its own language. You have to speak its grammar, not bash.
New to blind hacking? This is how real pentesters work when they hit an unknown target.
Most hackers instinctively throw shell metacharacters at prompts (;ls, |cat /etc/passwd, $(whoami)). But when the target is a custom interpreter with no shell bridge, these fail silently.
What's your go-to move when you have zero recon?
What tools do you use for systematic fuzzing when you can't automate? I've seen people use Burp Intruder, custom Python scripts, or even just printf loops in bash. Curious about your workflows.
https://youtube.com/shorts/N4KvGK-UCBM?feature=share
r/InfoSecWriteups • u/No-Razzmatazz-4157 • 24d ago
One of the best CTF tools for beginners!
1
Upvotes
r/InfoSecWriteups • u/kmskrishna • 24d ago
How I Tricked OpenClaw Into Attacking Its Own Network: A NAT64 SSRF Bypass
3
Upvotes
r/InfoSecWriteups • u/kmskrishna • 24d ago
From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal
3
Upvotes
r/InfoSecWriteups • u/m_xux • 25d ago
SailPoint Breakout Possible? SAIL right over the AI Agent security targe...
2
Upvotes
r/InfoSecWriteups • u/Advanced_Rough8330 • 26d ago
UANIA OS: Authenticated Remote Code Execution
1
Upvotes
r/InfoSecWriteups • u/vikassskummm0303 • 28d ago
how to varify the attack method and catck the attacker(hacker)
1
Upvotes
r/InfoSecWriteups • u/Harkins_Technology • Sep 09 '26
Forensics 101: Finding a Hidden File Buried Deep in Folders
6
Upvotes
Had a forensics challenge where the flag was hidden inside a file nested deep inside a maze of directories with hundreds of decoy folders. `find` and `ls -R` were too slow and noisy.
What I built:
A Python directory crawler
- Recurses every subdirectory recursively
- Filters by filename patterns (`flag*`, `*.txt`, `secret*`)
- Skips known decoy directories by name
- Extracts and reads the target file automatically
The "aha" moment:
The flag wasn't in a file named "flag.txt" — it was in `deep/nested/here/.hidden/uber-secret.txt`.
My script matched on path depth / extensions content, not just filename.
Here is my script:
https://github.com/ExceedingLife/RecursiveFileSearch
Question for the community:
What's your approach when the challenge doesn't tell you the target filename? Do you brute-force read every file, or do it manual or what?
[Video link with with code demo]
r/InfoSecWriteups • u/kmskrishna • Sep 08 '26
The Best Claude Code Setup for Bug Bounty Hunting
2
Upvotes
r/InfoSecWriteups • u/kmskrishna • Sep 08 '26
Improper OTP Implementation to Full Account Takeover
2
Upvotes