- MonkeHacks
- Posts
- MonkeHacks #51
MonkeHacks #51
Payoff, Statistics, Languages
MonkeHacks #51
We’re nearly at the 1-year milestone of MonkeHacks! I’ll make the next issue a great one, and I might do a giveaway of some kind. I had a pretty standard week - I went bouldering, and I went to the gym. On Thursday, I went to a language exchange to practice my spoken German and Arabic, and I met some great people there, so I’ll definitely go again next week. Time is flying by.

Great sunset from the city :)
Weekly Ideas / Notes
True to my prediction, I’ve started finding a few bugs with the assistance of my automation. It’s not quite fully automated - these are findings on assets that were picked up by my code, but the hacking process was still manual.
As much as I’d like to talk more about what I’m automating, it’s an area I don’t want to bring attention to, so you’ll have to forgive me for omitting it. I still need to make a living!
I split my time between coding and active hacking, so I ended up with several bugs this week. It was a nice change from just coding for the past month.
I got two great pieces of news this week that I can’t share, but you’ll find out in a few months. 2025 has been an insanely good year for me so far - like, so good that I didn’t see this coming at all.
There’s a lot of power in knowing different languages. Not just day-to-day, in speaking with people, but also in hacking. Knowing a language unlocks more scope - yes, you can use Google Translate to translate the entire page a lot of the time, but there’s a lot of areas where knowing how to read a particular language is a superpower. Reversing code with variable names that have been written in another language, for example.
I might do another 100-hour challenge or some other kind of challenge soon. I’ll make a poll on X soon!
Resources
The list is a bit short this week, but the Portswigger article should keep you very busy!
Top 10 web hacking techniques of 2024: the annual list is out! Congratulations, in particular, to my friend Kevin Mizu. He’s releasing Part 2 of his DOMPurify research soon, so give his XSS challenge a shot before he releases it!
Bypassing SMS OTP Authentication or a story behind $16.5k in bounties: This is a phenomenal article on using statistics to break OTP. I also found a bug last week using statistics, although mine was vastly simpler and more obvious. There is an entire bug bounty niche around statistics that is likely near-untouched.