CyberSecurity Research

Repository for researching and hunting vulnerabilities in the real-world scenario as well as automating them.

Started: 18th August 2024

Key:
✔️ : Completed
❌ : Incomplete
⭕ : In progress
◼️ : Web Application Notes
◻️ : Mobile Application Notes

Day 1:

• [✔️] Read about XSS through PDF
• [✔️] ◼️: Researched on automating enumeration techniques.
• [✔️] ◻️: Understanding SSL Pinning and learning Frida.

Day 2:

• [✔️] Researched on nuclei templates and reviewed basic tools such as subdomainer and httpx for recon.
• [✔️] Researched on axiom and shadowclone for recon.
• [✔️] Understanding SSL Pinning and learning Frida.

Day 3:

• [✔️] Overviewed reconnaissance tools
• [✔️] Understanding SSL Pinning and learning Frida.
• [⭕] https://gitlab.com/gitlab-org/gitlab/-/issues/452510

Day 4:

• [✔️] Researched on Shodan
• [✔️] Learning to break SSL Pinng using Frida and scripts from Codeshare.
• [⭕] Read about Stored XSS in diff

Day 5:

• [✔️] Researched on the reconnaissance for starting penetration testing.
• [✔️] Researched on mobile penetration testing through r2frida
• [✔️] Researched on client side vulnerabilities through the work of Youssef Sammouda

Day 6:

• [✔️] Researched on the tool netlas.io, used for recon.
• [✔️] Started Beyond XSS Chapter 1
• [⭕]

Day 7:

• [✔️] Researched on GAU and GAUplus for reconnaissance.
• [✔️] Completed Beyond XSS Chapter 1
• [⭕]

Day 8:

• [✔️] Researched further on reconnaissance for penetration testing.
• [✔️] Started Beyond XSS Chapter 2
• [⭕]

Day 9:

• [✔️] Multiple Recon techniques and automated XSS techniques in this article.
• [✔️] Completed Beyond XSS Chapter 2
• [⭕]

Day 10:

• [✔️] Learnt about a recon tool named Ashok
• [✔️] Started Beyond XSS Chapter 3
• [⭕]

Day 11:

• [✔️] Discovered a tool for automated recon and pentesting.
• [✔️] Continued Beyond XSS Chapter 3
• [⭕]

Day 12:

• [✔️] Watched live recon by Tomnomnom and Nahamsec on Youtube.
• [⭕]
• [⭕]

Day 13:

• [✔️] Used netlas.io to enumerate Github.com
• [⭕]
• [⭕]

Day 14:

• [✔️] Analyzed netlas.io results w.r.t Github.com
• [⭕]
• [⭕]

Day 15:

• [⭕] Checked out a list of search engines for recon.
• [⭕]
• [⭕]

https://www.hackthebox.com/blog/aws-pentesting-guide

https://blog.ankursundara.com/cookie-bugs/

https://security.googleblog.com/2024/11/leveling-up-fuzzing-finding-more.html

https://mizu.re/post/exploring-the-dompurify-library-bypasses-and-fixes

https://mizu.re/post/exploring-the-dompurify-library-bypasses-and-fixes

https://security.humanativaspa.it/extending-burp-suite-for-fun-and-profit-the-montoya-way-part-8/

https://blog.voorivex.team/from-an-android-hook-to-rce-5000-bounty

https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

https://www.yeswehack.com/learn-bug-bounty/pimpmyburp-signsaboteur-burpsuite-extension?utm_source=twitter&utm_medium=banner&utm_campaign=signsaboteur

https://gist.github.com/DanaEpp/ca4b612734e73b4cf46ae6eeab6626b6

https://blog.oversecured.com/Android-security-checklist-webview

https://laburity.com/performing-android-static-analysis-101-a-complete-guide-for-beginners/

https://shreyaschavhan.notion.site/The-4M-Methodology-for-Choosing-the-Right-Bug-Bounty-Programs-to-Hunt-On-Cross-Applying-Finance-to-144a53e43119800e87e0d1039235c6c9

https://dvuln.com/blog/modern-ios-pentesting-no-jailbreak-needed

https://blog.convisoappsec.com/en/introduction-to-fuzzing-android-native-components/

https://blog.intigriti.com/hacking-tools/broken-authentication-a-complete-guide-to-exploiting-advanced-authentication-vulnerabilities