Sergey Bobrov

[Sergey Bobrov @Black2Fan]

https://t.co/GnkQkaGkDR

Burp Suite and Caido extension that simplifies working with signed requests. Supports Sigv2/v4 , including SigV2 generation through Hackvertor tags.

It can also generate signatures from SignatureDoesNotMatch errors when requests are modified by a proxy.

[Sergey Bobrov @Black2Fan]

I took part in the "Getting Started in Bug Bounty" episode on Standoff 365, where we discussed S3 misconfigurations in web applications.

https://t.co/00m5dKkbeG [RU]

[Sergey Bobrov @Black2Fan]

https://t.co/kGqeg0nqo8

A reference table of popular cloud and self-hosted S3-compatible solutions that helps identify which storage system a website is interacting with.

[dbugs @ptdbugs]

📄 Cache Poisoning via S3 API: when JavaScript caching becomes an attack vector

A common setup: a site stores static assets in S3, proxies requests to it, and caches "200 OK" responses. At first glance, everything looks correct — but one cache configuration detail turns this into a vulnerability.

Query parameters are not included in the cache key. As a result, "/app.js" and "/app.js?anything" are treated as the same resource by the cache.

However, S3 is not just a file store — it exposes a REST API with object-level operations that also return "200 OK" responses:

🟡 "?tagging" — returns XML with object tags instead of file content
🟡 "?acl" — returns XML with access permissions

An attacker requests
│ /app.js?tagging

The proxy forwards the request to S3 → S3 responds with XML and a "200 OK" → the proxy caches this response as the content for "/app.js" → all users subsequently receive XML instead of JavaScript. The application breaks for the duration of the cache lifetime.

Even if "?tagging" and "?acl" are disabled, another vector remains. The S3 "GetObject" API supports the parameter:
│ ?response-content-type=text/html

S3 returns the correct file but overrides the "Content-Type" header. The cache stores the response with "Content-Type: text/html". The browser receives the script as HTML and does not execute it. The result is the same — application functionality is disrupted.

📎 https://t.co/kse0g9GGyl

#dbugs_attacks

[Sergey Bobrov @Black2Fan]

Implemented support for annotation parsing in class constructor arguments in BFScan.

https://t.co/dG6XD7f2uI

If previously a lot of HTTP requests with obfuscated parameter names were generated for your APK, now the result should improve significantly.

[Sergey Bobrov @Black2Fan]

Wrote a Burp Suite Pro extension that uses AI-powered features to replace values in HTTP requests.

Useful for guessing data formats based on parameter or header names. For example, for requests from Swagger / OpenAPI or those generated by my tool BFScan.

https://t.co/BXwXWr7OM6

[Sergey Bobrov @Black2Fan]

Which libraries define http endpoints in a similar way to add support for them?

[Sergey Bobrov @Black2Fan]

I have published a tool based on jadx that helps analyze Java applications.

https://t.co/jVTKEM9fIc

BFScan generates HTTP requests and OpenAPI specs based on config files and class/method annotations.
It also searches strings that look like URIs, paths, or secrets.

[Sergey Bobrov @Black2Fan]

I have published a tool based on jadx that helps analyze Java applications.

https://t.co/jVTKEM9fIc

BFScan generates HTTP requests and OpenAPI specs based on config files and class/method annotations.
It also searches strings that look like URIs, paths, or secrets.

[Sergey Bobrov @Black2Fan]

A note about a vulnerable nginx configuration related to proxying requests to S3 [RU]:

https://t.co/iNSIEefjxN

[slonser @slonser_]

In 2024, I interacted a lot with Extensions.

I decided to create a resource that will help with a basic understanding of extensions and key attacks.

P.S. I tried to make everything as clear as possible and hope it won’t feel too overwhelming anywhere.

https://t.co/mnI255djn8

[Bug Bounty Reports Explained @gregxsunday]

Content-Type research by @Black2Fan
https://t.co/CO0mQqrRKx
#BBRENewsletter81

[Moopinger @moopinger]

New blog post https://t.co/JiAWXQJhfI Inspired by the great work of @Black2Fan

[PortSwigger Research @PortSwiggerRes]

The results are in! We're proud to announce the Top 10 Web Hacking Techniques of 2023! https://t.co/KhiMEHP1dh

[Dinesh Shetty @Din3zh]

CVE-2024-21633 - MobSF Remote code execution detailed writeup https://t.co/3ZkfpZ6V35 #MobileSecurity #infosec

[slonser @slonser_]

A writeup analysis of a simple logical vulnerability at @googlechrome for which @GoogleVRP paid me $16,000.
Link: https://t.co/YMpxGVQCSo
P.S. I have very few subscribers, so I am grateful for every repost
#0day #Chrome #GoogleVRP #CVE

[Masato Kinugawa @kinugawamasato]

Here is the technical details of MS Teams RCE I used in Pwn2Own Vancouver 2022!

#shibuyaxss の資料公開しました！Pwn2Ownで賞金を獲得したTeamsの脆弱性について解説しています。

https://t.co/vD4umM9LWa (English)
https://t.co/3FyDMQjFET (日本語)
https://t.co/yz4pcHKsZv (demo)

[Sergey Bobrov @Black2Fan]

@0xHe1 @binitamshah Not sure if this is still relevant.

https://t.co/sbG5Ejhhjz

[Sergey Bobrov @Black2Fan]

@gregxsunday Also, depending on the parser, you may need to use multipart/form-data or text/plain in the original html form.

[Sergey Bobrov @Black2Fan]

HTTP Request Splitting vulnerabilities exploitation

https://t.co/6cvM7XD9FY

[Sergey Bobrov @Black2Fan]

@gregxsunday Yes that's right. We can form the correct ending of a multipart request using the POST parameters of the original request.