MonkeHacks #03

100-Hour Challenge Updates

Here are this week’s statistics:

I’m currently in Edinburgh to meet my good friend Mikey96. We collaborated on my challenge target and we spent ~15 hours chaining various issues together into a cool bug. Hopefully I’ll have some good news about it in the next issue.

Weekly Ideas / Notes 

• The OpenAI API supports a `response_format` option to force the model to return data in JSON format.

• If you’re writing a tool in Python, please consider using generators instead of simply saving large quantities of data in an array. This could lead to vast performance improvements.

• Following on from that point, comment your own code properly! With larger codebases, it’s very difficult to go back to what you were working on if you have no comments. This is especially applicable if you’re writing automation.

• Contrary to popular belief, it is entirely possible for manual hackers to compete with people who run large-scale automation. Manual hacking inevitably results in leads that are much, much higher quality than those produced by automation, and AI hasn’t progressed far enough to substitute human pattern recognition in its entirety yet. So, in this regard, don’t feel that you have to develop automation. Simply working on your manual skills on the right programs is sufficient to keep up with modern bug bounty.

Project Updates

• I’m gathering footage to create a hacker-vlog. Expect some more news soon. It might be a YouTube channel.

• Lastly, this issue is a bit short because I was busy this past week. Expect next week to be a lot more interesting!

Resources 

• Shell Nodes in Caido’s Passive Workflows

• Hacking Cloudflare Pages Part 2

• JetBrains TeamCity Authentication Bypass