#dailyread was tij.me/blog/harvesting-activ… an awesome write-up documenting abusing a HTTP Request Smuggling vulnerability in order to MiTM a domain user's Exchange mail sync. As the Exchange server was using Basic Auth they were able to steal credentials, however being a red team 1/

engagement they took it a few steps further and hosted a rogue service which would update the user's Exchange server in the account settings. This got me excited about request smuggling all over again. The impact of this goes way beyond stealing cookies or turning a self-XSS 2/

#dailyread was blog.scrt.ch/2023/03/14/prod… and right off the bat I notice that the author makes a point to mention various small failures they experienced throughout the process. In this case the process was attempting to create a working PoC for an exploit being used by 1/

with understanding of some more advanced concepts. The author's clear and even candid writing style makes it feel like we are there for the entire process making it much easier to understand even if exploit dev and reverse engineering isn't your thing. In the end they were 3/

#dailyread - blackhillsinfosec.com/your-b…. To summarize, the researcher was able to find stealer logs working on something unrelated to a red team engagement. They searched the logs and found references to Citrix logins which they used in a credential stuffing attempt against their /1

target. This did not work, but some of the information (there was 10TB) was related to a username which was valid for their client. This probably isn't news to a lot of people, but the takeaway is that you should think twice before saving sensitive information in your browser 2/

#dailyread was trickest.com/blog/hundreds-o… from the Trickest team. They identified over 550 AWS servers vulnerable to Host header-based SSRF across the entire range. One thing I enjoy about this article is that they broke down the whole workflow of how they tooled the process 1/

#dailyread today was marvelmaniac.medium.com/b4c8…. What started as an open redirect eventually turned into a full blown account takeover, going to show you why it's good to not settle when it comes to your bugs. I'll make a quick summary here but you'll miss out on good information 1/

directives and snag a cookie in the face of restrictions. Numerous bypasses and encodings were used to get this to work. The main takeaway I have for this is that building impact is like building almost anything else worth building. It starts with one piece and only after 3/