Posts

A note on scope: This is my first published piece of threat analysis. I built a custom honeypot as a learning project, and this post documents what I observed. I applied structured analytic standards (the NATO Admiralty Scale for evidence grading, ODNI-derived confidence levels, and Analysis of Competing Hypotheses) so that assessments are defensible rather than informal. Definitions for these frameworks are in Appendix B. I welcome corrections and feedback from more experienced researchers. ...

Blog is live. This is where I’ll be dropping notes on security research, bug bounty findings, infrastructure experiments, and whatever else crosses the terminal. What to expect Posts will cover: Offensive security — techniques, methodology, tool notes Bug bounty — write-ups (where disclosure allows), recon approaches, automation Infrastructure — homelab, cloud setups, things I break and fix Random builds — scripts, tools, side projects If you want to know more about me, head over to abartan.net. ...

This article was originally published on SecJuice on August 30, 2020. In this article I am going to geek out over Spyse, a new cybersecurity search engine I have started using. It provides similar services to that of Shodan and has many similar functions from my personal perspective. I will be describing some of the things I found to be really good and some of the easier options in this service compared to others I have used in my bug bounty hunting career. ...

This article was originally published on SecJuice on September 8, 2019. For this article I am going to share my recent findings from Bugcrowd a bug bounty, which for the purposes of this article I will call Program X. This was the first four figure bug bounty I had ever won and it was a fantastic feeling. Come weekends I have a ton of energy I need to burn and I tend to burn that energy looking for bugs. After spending two days solid and finding a few different bugs which bounties can be claimed on, it made me realize that there are still lots of vulnerabilities to be found. ...

This article was originally published on SecJuice on May 26, 2019. One night I was waiting for a friend to do some collaborative bug bounty hunting and I was bored, so I thought of checking my local network to see if someway I could see anything remotely from a PS4 that I recently bought in order to exploit. But instead of my PS4 I saw something else that caught my attention, this time I saw something really really strange and this is the story of my ChromeCast bug. ...

This article was originally published on SecJuice on March 31, 2019. Hello everyone, I have returned from my travels to write for our very own awesome Secjuice. I was doing a bit of traveling around different timezones and attending some awesome conferences. Thanks to my employer, I managed to visit my first ever international infosec conference and then a week after returning back to Sydney, I went to another infosec conference, the second conference ever in my life! ...

This article was originally published on SecJuice on January 27, 2019. Today I want to talk about one of my favourite vulnerabilities right up to where my knowledge gap begins, like you I am still learning and writing about the things I am learning about is my way of retaining the knowledge. Before jumping straight into a highly paid vulnerability, a quick word on authorization and authentication. Authentication lets the application know who is using an app, while authorization means the level of features you have and the level of actions you can perform. ...

This article was originally published on SecJuice on November 25, 2018. In this article I tell the story of the success I have had finding Google vulnerabilities, a success that is underpinned by LOTS of failure. This is the story of of how I turned my invalids into valid vulnerabilities and got into the Google Hall of Fame and hopefully will help you out during penetration test or during bugbounty hunting. ...

This article was originally published on SecJuice on November 4, 2018. The very first encrypted messages were developed in ancient Egypt as series of disordered hieroglyphics. This was a very simple means of encryption using a method called simple substitution. The original message was encoded using a substitution cipher. Each letter of the plaintext was simply replaced by another letter of the alphabet, resulting in the encoded message, or cipher text. ...

This article was originally published on SecJuice on August 26, 2018. This is a very basic article written especially for those of you who want to get started in hacking, but don’t know how to start. This article could be useful to beginners as well who have already started their path but got lost along the way, or those who are in dilemma where they are making mistakes. If you are an elite hacker, please do help by making suggestions on this article. I would like to thank all the readers in advance. You guys are awesome. ...