hacking-resources

This will contain notes , techniques and tools used for pentesting , bug bounty and general hacking stuffs that i am trying to learn

Android security resources

• Android SSL pinning bypass

  • https://vavkamil.cz/2019/09/15/how-to-bypass-android-certificate-pinning-and-intercept-ssl-traffic/
  • https://blog.netspi.com/four-ways-bypass-android-ssl-verification-certificate-pinning/
  • https://securitychops.com/2019/08/31/dev/random/one-liner-to-install-burp-cacert-into-android.html
  • https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/

• Deep link writeups

  • https://hackerone.com/reports/328486
  • https://hackerone.com/reports/401793
  • https://hackerone.com/reports/583987

• Bug Bounty resource

  • https://www.youtube.com/watch?v=OLgmPxTHLuY

• Android Native library reversing

  • https://www.youtube.com/watch?v=s0Tqi7fuOSU
  • https://maddiestone.github.io/AndroidAppRE/reversing_native_libs.html

• Amazon cognito authorization issues

  • https://github.com/riddhi-shree/nullCommunity/tree/master/Android/amazon_cognito_authz_issue

Container Security

• DEF CON 26 - Wesley McGrew - An Attacker Looks at Docker Approaching Multi Container Applications
• How Abusing Docker API Led to Remote Code Execution, Same Origin Bypass & more
• Vulnerability Exploitation In Docker Container Environments

Cloud security writeups

• GCP
  • https://about.gitlab.com/blog/2020/02/12/plundering-gcp-escalating-privileges-in-google-cloud-platform/
  • https://www.bsidesmelbourne.com/2020-plundering-gcp.html
• AWS
  • https://blog.truesec.com/2020/02/12/from-s3-bucket-to-laravel-unserialize-rce/
• Apple iCloud
  • https://www.secjuice.com/apple-icloud-credential-stealing/
• Kubernetes
  • https://research.nccgroup.com/2020/02/12/command-and-kubectl-talk-follow-up/
  • Kubernetes security
• Generic Cloud
  • Continuous cloud security monitoring

IOT security resources

• https://research.nccgroup.com/2020/02/10/interfaces-d-to-rce/
• https://github.com/scriptingxss/IoTGoat

ARM Assembly reverse engineering

• https://azeria-labs.com/writing-arm-assembly-part-1/

OAuth Security

• Introduction
  • https://www.youtube.com/watch?v=CPbvxxslDTU
• Best Practices
  • https://tools.ietf.org/id/draft-ietf-oauth-security-topics-08.html
• Common Attacks
  • http://blog.intothesymmetry.com/2015/12/top-10-oauth-2-implementation.html
  • https://ldapwiki.com/wiki/OAuth%202.0%20Vulnerabilities
• Examples
  • https://hackerone.com/reports/202781
  • hackerone.com/reports/314814
  • hackerone.com/reports/110293
  • https://hackerone.com/reports/210779

Bug Bounty Writeups

• A Tale of Two Formats: Exploiting Insecure XML and ZIP File Parsers to Create a Web Shell
• Stealing Data using xss

Conferences

• Appsec California 2020

CTF resources

• https://ctf101.org/
• UTCTF 2020 bof writeup

Everything

• What i have learnt from first month of hacking and BB