Reconless

Security research, blogs, and videos by @filedescriptor, @ngalongc & @EdOverflow

YouTube:

[Reconless @0xReconless]

Brilliant finding by sateeshn. @gitlab remains one of the best programmes to learn from thanks to their transparency. 👏

[publiclyDisclosed @disclosedh1]

GitLab disclosed a bug submitted by sateeshn: https://t.co/fHjP9WmK7W - Bounty: $12,000 #hackerone #bugbounty

[Reconless @0xReconless]

@chybeta @ngalongc While one may think sateeshn was inspired by our video, we believe this bug was introduced after the video was made. Please do not direct any hate towards sateeshn. This is a brilliant finding. ❤️

[Reconless @0xReconless]

New blog post by @EdOverflow 👇

[Ed @EdOverflow]

As promised, a blog post in response to a reader's email.

"Reading RFCs for bug bounty hunters" — https://t.co/FbeNU0W8IW.

This blog post covers how reviewing RFC literature can be beneficial for bug bounty hunters, and includes tricks for speeding up the reading process.

[Reconless @0xReconless]

Reconless member @EdOverflow is doing a bug bounty Q&A series on https://t.co/WAoFsAHq9t.

[Ed @EdOverflow]

You shared topics you would like to see bug bounty hunters blog about. Here is an opportunity to be featured in my next blog post and have your bug bounty questions answered.

➡️ Send me a DM or email with your question, and I will respond to the best questions in a blog post.

[Ed @EdOverflow]

What is something you wished bug bounty hunters would blog more about?

[Reconless @0xReconless]

Ed has published a new blog post on DOM-based XSS. 👇 #bugbountytips

[Ed @EdOverflow]

New blog post: "What Bypassing Razer's DOM-based XSS Patch Can Teach Us" — https://t.co/XnuUUFgsS3.

[Reconless @0xReconless]

@tabaahi_ We highly recommend HTTPVoid's videos on the subject: https://t.co/JZ1dfh67Jw.

[Reconless @0xReconless]

@hunter0x8 @ManasH4rsh @TomNomNom @filedescriptor 👀

[Reconless @0xReconless]

https://t.co/PPCO0evFj0 by @S1r1u5_

[Reconless @0xReconless]

Don't assume XSS in out-of-scope/sandboxed domains is not worth reporting! Check out how you can escalate it for a bigger impact in this video.

https://t.co/MLgI08G8ai

[LiveOverflow 🔴 @LiveOverflow]

Somebody told me you can find exclusive videos from @Farah_Hawaa @PwnFunction @0xReconless @ghidraninja and @LiveOverflow on there 🤫

[The Daily Swig @DailySwig]

‘Soft skills are the most under-researched area of the bug bounty industry’ – ‘Reconless’ YouTubers (@0xReconless ) on filling a gap in infosec education https://t.co/C0OQVzVc0x

[Reconless @0xReconless]

The absolute state of YouTube

[Reconless @0xReconless]

Do you spell it CSRF or XSRF?

[Reconless @0xReconless]

Don't assume XSS in out-of-scope/sandboxed domains is not worth reporting! Check out how you can escalate it for a bigger impact in this video.

https://t.co/MLgI08G8ai

[Reconless @0xReconless]

Ever wondered how an exploitation and the impact of a JWT bug look like? Check out our latest video, where we exploit a critical JWT without a signature to take over any account without user interaction on Microsoft Outlook! https://t.co/8N5cJ3jmZ2

[Reconless @0xReconless]

Check out our latest video in the 1Password Hacking series, where how @ngalongc found simple API bugs that nobody had looked at after decrypting the protocol!

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Love this video by @0xReconless😍😍😍 Finding DOMXSS with DevTools | Untrusted Types Chrome Extension https://t.co/8n9El4gBpv via @YouTube

[Reconless @0xReconless]

As a frequent request, we have made a video covering how to find DOMXSS with DevTools! @filedescriptor walks through how to use Untrusted Types to turn a manual process into semi-automated.

https://t.co/D4Rg1EnkHK

[Reconless @0xReconless]

Check out how @ngalongc cracks open the data encryption in this episode of Hacking @1Password!