🚀 This week's UL is live! Featuring: 🌐 Launching 2025 📂 US soldier data leak 🤖 AI agents begin to emerge 🇨🇳 China’s global spy network revealed 🚕 Robotaxis now safer than human drivers newsletter.danielmiessler.com/p/ul-463

UL NO. 463 | Launching 2025, US Soldier Data Leak, AI Agents Emerge, China's Global Spy Network, Robotaxis Now Safer Than Humans

Navigating AI's impact on work, the rise of transnational threats, a grim new reality in air travel, and how to harness the chaos of 2025 for personal and professional growth

newsletter.danielmiessler.com

TIL: Array.fromAsync([1],alert)

We released our 100th episode of @ctbbpodcast.bsky.social yesterday - really proud of the whole CTBB team! We're sad to be losing @teknogeek.io, but very hopeful for future of the pod! We're going to lean more into the discord community and keep producing HQ technical content in 2025.

Yo, new big thing: Shift. AI seamlessly integrated into your HTTP proxy. Use cases: "Take this JS and build the JSON request body" "Fill in these IDs from my notes - UserA" "Create a match and replace rule to turn on this feature flag" "Generate a wordlist with all HTTP Verbs"

We spend a lot of time talking to the hackers, but today, we're dropping a goodie for the program managers! Here are our top tips for running a kickass bug bounty program. See the matrix at the end for high impact to hackers, low effort changes. blog.criticalthinkingpodcast.io/p/program-ma...

Program Manager’s Guide To Running a Successful Bug Bounty Program

How to run a bug bounty program hackers will love to hack on.

blog.criticalthinkingpodcast.io

Bash tip: hit ctrl+x then ctrl+e to edit your current command in $EDITOR, write and quit to run it

If you are interested in client-side hacking and browser quirks I strongly recommend going through this writeup by @maitai.bsky.social! It was also cool to collab w/ him on the second chall 🤜🏿🤛🏻 blig.one/2024/11/29/f...

Pro-tip: gron is awesome for diffing JSON 🥰 github.com/tomnomnom/gron

This week we've got a rare episode that is also a bit more beginner friendly! 0xLupin (of Lupin and Holmes) and @rhynorater.bsky.social breakdown some of the hacker mentality that really caused some breakthrough in their hacker growth. Check it out! youtu.be/yxc2jVKE-jo

Back to the Basics - Web Fundamental to 100k a Year in Bug Bounty (Ep. 99)

YouTube video by Critical Thinking - Bug Bounty Podcast

youtu.be

I talk about this on the pod all the time, but CSRF is dead simple. You just need to know the conditions. I'm not gonna recite them again here, but today a new condition came up: No Content-Type header -> no CSRF restrictions Same-site: None POST = CSRF The research:

Alright, new platform so I'm going to start sharing some things that I'm excited about to keep the momentum flowing! Rn, I think the 403 Bypasser Caido plugin from Bebiks is freaking amazing. This is a tool to automate the bypassing of walled-off endpoints. This plugin does 3 things right:

Great times with these gents

TomNomNom@tomnomnom.com · 2y ago

miss these guys

Really sick research here

April King@april.social · 2y ago

Handling Cookies is a Minefield: Inconsistencies in the HTTP cookie specification and its implementations have caused a situation where countless websites (including Facebook, Netflix, Okta, WhatsApp, Apple, etc.) are one small mistake away from locking their users out. grayduck.mn/2024/11/21/h...

Kinda came kicking and screaming to this app at the thought of having another app to open and post too, but I'm gonna give it a shot to see how the community is!