You've identified a possible SQLi 🤑

But WAF is in the way... 😓

What if you could just bypass this WAF and get your payload through? 🤠

In our latest article, we documented several ways to identify the origin IP of your target behind popular CDNs and firewalls!

🔗 www.intigriti.com/researchers/...

Need some extra help? Check out our in-depth server-side request forgery exploitation article for some clues! 👇

www.intigriti.com/researchers/...

Coworker: ...and the IP address are compared with a string match.
Me: *grinning manically*
Coworker: Why are you looking at me like that?
Me: Open up a terminal and type `ping 4.2.514` and hit enter.
Coworker: ...what's the fourth number?
Me: *grin widens* Just hit enter.
Coworker: WTF!?

IP addresses are just numbers, and there are many ways to write them :)

OMG I just found out you can do this:

export MANPAGER='vim +MANPAGER --not-a-term -'

to use vim as your man pager.

It has syntax highlighting. You can jump to other man pages by pressing 'K' <3

Another fun vim thing: if you omit the 'search' part of a search and replace (e.g :%s/search/replace/), it uses the last thing you searched for. Coupled with being able to use * to search for the thing under your cursor can make for quicker replacements :)

Pro-tip: gron is awesome for diffing JSON 🥰

github.com/tomnomnom/gron

Bash tip: hit ctrl+x then ctrl+e to edit your current command in $EDITOR, write and quit to run it

Sneaky vim tip contained within: ctrl+a increments the number under the cursor, jumping forward to the next number if you're not on one currently. Ctrl+x decrements instead

‪Once again all completely 100% free, check it out below!‬

‪🔗 : www.justhacking.com/uc/uc-websoc...

Just dropped another completely free API security lesson on JustHacking, this time we’re looking at WebSocket APIs. In this 30min lesson you’ll learn what a WebSocket is and the types of apps that use them, how to communicate to WebSockets and some of the security issues in them!

I've done a whole bunch of talks, interviews and stuff on other people's YouTube channels over the years so I'm going to try and catalog them here.

First up is a video with my good friend STÖK in which I demo some big bounty workflow stuff.

This one is special.

youtu.be/l8iXMgk2nnY