MonkeHacks #50

Welcome back to another issue of MonkeHacks. Plenty of good articles to read this week. It’s quite cold here, 2-3°C or 36°F. It’s been a really busy week on my end, between work and other things. I had my bouldering competition this week.

Time is really flying by - I had a really good January and made significant progress towards nearly all of my goals for the year. I’m determined to keep this good momentum going into February. My German ability has also progressed noticeably in the past month or so. I meant to go to a language exchange this week, but I was too tired, so I’ll go next week instead.

Weekly Ideas / Notes 

• This week, I continued to expand my automation, adding new services and fixing old ones. There’s not much I can add to this because it’s mostly just me squashing stupid bugs with o1 and Cursor. The codebase is progressing really nicely and I think I’ll get my first bugs with it sometime this month.

• I continued working on my ongoing pentest, which has been going well! I had an interesting, somewhat unique finding so that was satisfying.

• I’ve been working on a side gig with a friend of mine, and we have a conversation with a potential design partner soon!

• I took part in my first bouldering competition, which was really fun. I lost to my friend by 1 point (111 points vs 112 points) so needless to say, I’m determined to win next time. The new bouldering shoes really helped.

• Once my automation is mostly satisfactory, I’ll take up a manual hacking challenge again. I didn’t do any manual hacking at all in January because my pentest work gave me enough leeway to focus on automation - I need to use the time I’ve “bought” to get the codebase working and profitable before I return to manual hacking.

• January Review: It was eventful!

  • I visited Austria with my friend.

  • I joined the Bugcrowd Hacker Advisory Board.

  • I read 1.5 books!

  • I did two pentesting assignments that gave me a stable amount of leeway for the next few months.

  • I made huge progress on my automation codebase, which is nearing profitability.

  • My side gig made good progress, although I can’t say more about this yet.

  • I took part in my first bouldering competition, which was really fun.

  • Some of my close friends hit incredible milestones - rez0 and Hacktus went full-time in bug bounty, Balint found an incredible bug, and some more of my friends landed their first bounties! So proud of all of you.

Resources

• Clone2Leak: Your Git Credentials Belong To Us: Ryotak inches closer to destroying the modern internet entirely.

• CSS Injection XS-Leak: A very clever cross-site leak using CSS-based renderer crashes. Just fascinating.

• Attacks on Maven proxy repositories: Great in-depth article on a series of vulnerabilities discovered in Maven proxy repos.

• World’s First MIDI Shellcode: Quite a bit outside of my expertise but I found this to be really interesting. It goes into amazing depth about the methodology and process of reverse-engineering a keyboard.

• Get FortiRekt, I Am The Super_Admin Now - Fortinet FortiOS Authentication Bypass CVE-2024-55591: A rare websocket vulnerability! I love websockets. Good work as usual from watchTowr.