Daily Writeups
@Daily_Writeups
3.49K subscribers
2 photos
129K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.49K subscribers
Daily Writeups
⤷ Title: PrivKit: simple beacon object file that detects privilege escalation vulnerabilities
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:33:20 +0000
════════════════════════
⌗ Tags: #Open Source Tool #privilege escalation #PrivKit
Penetration Testing Tools
PrivKit: simple beacon object file that detects privilege escalation vulnerabilities
PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
29 views
Daily Writeups
⤷ Title: One Username to Rule Them All: The Persistent RCE Shadow Haunting Control Web Panel
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:19:49 +0000
════════════════════════
⌗ Tags: #Vulnerability #AlmaLinux #centos #Control Web Panel #CVE_2025_48703 #CVE_2025_70951 #CWP #Fenrisk #Linux Hosting #RCE #remote code execution #Rocky Linux #Server Security
Penetration Testing Tools
One Username to Rule Them All: The Persistent RCE Shadow Haunting Control Web Panel
A profound architectural frailty has been unearthed within a ubiquitous server management console, permitting an adversary to usurp
21 views
Daily Writeups
⤷ Title: Sovereign Control: How “Multi-Layered” Rowhammer Flips Bits to Hijack NVIDIA GPUs
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:18:11 +0000
════════════════════════
⌗ Tags: #Vulnerability #Ada Lovelace #Ampere #GDDR6 #GPU Security #hardware exploit #InfoSec 2026 #Linux Kernel #Nvidia #RAM Corruption #Rowhammer #RTX 3060 #RTX A6000
Penetration Testing Tools
Sovereign Control: How "Multi-Layered" Rowhammer Flips Bits to Hijack NVIDIA GPUs
A sophisticated evolution of the venerable Rowhammer assault has unexpectedly yielded ramifications far more profound than previously envisioned.
14 views
Daily Writeups
⤷ Title: The Long Game: How North Korea’s UNC4736 Spent Six Months Infiltrating Drift for a $285M Payday
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:15:09 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AppleJeus #Blockchain Security #Crypto Hack 2026 #Drift Protocol #Golden Chollima #North Korea #Social Engineering #Solana #TestFlight Malware #UNC4736 #Visual Studio Code Exploit
Penetration Testing Tools
The Long Game: How North Korea’s UNC4736 Spent Six Months Infiltrating Drift for a $285M Payday
The recent incursion into the cryptocurrency sanctuary Drift, which culminated in the exfiltration of $285 million, has been
19 views
Daily Writeups
⤷ Title: The 15-Second Takeover: How North Korea’s UNC1069 Hijacked Axios and 100 Million Users
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:10:47 +0000
════════════════════════
⌗ Tags: #Malware #axios #Cybersecurity 2026 #North Korea #npm #OIDC #plain_crypto_js #Remote Access Trojan #SILKBELL #Social Engineering #supply chain attack #UNC1069 #WAVESHAPER
Penetration Testing Tools
The 15-Second Takeover: How North Korea’s UNC1069 Hijacked Axios and 100 Million Users
The ubiquitous JavaScript library axios, a cornerstone utilized by millions of digital architectures, was transfigured for several hours
13 views
Daily Writeups
⤷ Title: The Invisible Army: Why 78% of Residential Attackers Bypass Modern IP Reputation
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:08:53 +0000
════════════════════════
⌗ Tags: #Malware #behavioral analysis #Botnets #Cybersecurity 2026 #Device Fingerprinting #GreyNoise Intelligence #Infosec #IoT Security #IP Reputation #network security #Residential Proxies
Penetration Testing Tools
The Invisible Army: Why 78% of Residential Attackers Bypass Modern IP Reputation
Corporate firewalls have long been accustomed to relying upon the reputation of IP addresses; however, nascent analysis indicates
11 views
Daily Writeups
⤷ Title: The Unbreakable Vault: Why Apple’s Lockdown Mode Has Never Been Cracked by State-Sponsored Spyware
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:07:39 +0000
════════════════════════
⌗ Tags: #Apple #Vulnerability #Cybersecurity 2026 #Infosec #iOS Security #iphone #Lockdown Mode #Mobile Privacy #NSO Group #Pegasus #Pegasus malware #Spyware #Tech News
Penetration Testing Tools
The Unbreakable Vault: Why Apple’s Lockdown Mode Has Never Been Cracked by State-Sponsored Spyware
Throughout the nearly four-year tenure of Lockdown Mode, not a single iPhone fortified by this defensive posture has
11 views
Daily Writeups
⤷ Title: Signalgate in Brussels: Why the EU Commission is Forcing Officials to Dissolve Secret Chat Groups
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:03:34 +0000
════════════════════════
⌗ Tags: #Cyber Security #Brussels #Cybersecurity 2026 #data breach #EU Commission #Infosec #Messaging Security #National Security #phishing #Signal #Signalgate #WhatsApp
Penetration Testing Tools
Signalgate in Brussels: Why the EU Commission is Forcing Officials to Dissolve Secret Chat Groups
The European Commission has mandated that a contingent of high-ranking officials dissolve a collective Signal discourse previously utilized
9 views
Daily Writeups
⤷ Title: Game Over? Hasbro Battles Formidable Cyber Offensive Against Iconic Toy Empire
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:59:25 +0000
════════════════════════
⌗ Tags: #Data Leak #Corporate Security #cyberattack #data breach #Hasbro #Infosec #Magic The Gathering #monopoly #Ransomware 2026 #SEC Disclosure #Toy Industry #Transformers
Penetration Testing Tools
Game Over? Hasbro Battles Formidable Cyber Offensive Against Iconic Toy Empire
The preeminent toy manufacturer, Hasbro, has been besieged by a formidable cyber offensive, the repercussions of which may
10 views
Daily Writeups
⤷ Title: UAT-10608 Collective Hijacked 700+ Next.js Servers in Hours
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:57:14 +0000
════════════════════════
⌗ Tags: #Malware #Vulnerability #Cisco Talos #cloud security #Credential Harvesting #CVE_2025_55182 #Cybersecurity 2026 #Next.js #React2Shell #remote code execution #supply chain attack #UAT_10608
Penetration Testing Tools
UAT-10608 Collective Hijacked 700+ Next.js Servers in Hours
Cybersecurity specialists have chronicled a voluminous, automated campaign for credential harvesting that, within a mere matter of hours,
8 views
Daily Writeups
⤷ Title: Legacy Shadows: OpenSSH 10.3 Eradicates Decades-Old “Berkeley rcp” Security Flaws
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:55:48 +0000
════════════════════════
⌗ Tags: #Vulnerability #Berkeley rcp #CVE_2026 #Cybersecurity 2026 #Infosec #Linux Security #Network Protocol #OpenSSH 10.3 #privilege escalation #SCP #Shell Injection #SSHD
Penetration Testing Tools
Legacy Shadows: OpenSSH 10.3 Eradicates Decades-Old "Berkeley rcp" Security Flaws
The OpenSSH architects have promulgated version 10.3—an iteration that proves significantly more profound than a mere routine synchronization.
10 views
Daily Writeups
⤷ Title: Digital Wraiths: How Android’s “God Mode” is Turning Smartphones into Banking Trojans
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:52:53 +0000
════════════════════════
⌗ Tags: #Android #Malware #Accessibility Service #Android 17 #Android malware #banking trojan #India Cybercrime #Infosec #phishing #SBI YONO Scam #Smartphone Security #WhatsApp Malware
Penetration Testing Tools
Digital Wraiths: How Android’s "God Mode" is Turning Smartphones into Banking Trojans
Digital marauders have devised methodologies to transmute mundane Android smartphones into entirely subjugated apparatuses. Indian authorities report that
20 views
Daily Writeups
⤷ Title: Speeding Up the Web: Chrome 148 Extends “Lazy Loading” to Video and Audio Tags
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:44:36 +0000
════════════════════════
⌗ Tags: #Technology #Bandwidth Saving #Browser Performance #Chrome 148 #Chromium #google chrome #HTML5 Audio #HTML5 Video #Lazy Loading #Web Development 2026 #Web Optimization
Daily CyberSecurity
Speeding Up the Web: Chrome 148 Extends "Lazy Loading" to Video and Audio Tags
Google Chrome 148 introduces native "Lazy Loading" for video and audio tags. Save bandwidth and boost loading speeds with this essential 2026 web update.
13 views
Daily Writeups
⤷ Title: Exploit Code Live: Full Technical Details and PoC Disclosed for Critical CWP RCE Vulnerability
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:42:55 +0000
════════════════════════
⌗ Tags: #Vulnerability #CentOS Web Panel #Command Injection #Control Web Panel #CWP #Exploit Disclosed #infosec #Linux Security #PoC #rce #Web Panel Security
Daily CyberSecurity
Exploit Code Live: Full Technical Details and PoC Disclosed for Critical CWP RCE Vulnerability
Fenrisk releases full PoC exploit for CVE-2025-48703, a critical CWP RCE flaw. Learn how unauthenticated attackers hijack non-root users. Patch now!
11 views
Daily Writeups
⤷ Title: Iran-Linked “Password Spraying” Targets Municipal Response to Missile Strikes
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:15:23 +0000
════════════════════════
⌗ Tags: #Cyber Security #BDA #Check Point Research #cyber_espionage #Gray Sandstorm #infosec #Iran #Israel #Kinetic Warfare #Microsoft 365 #Municipal Security #Password Spraying #UAE #VPN Evasion
Daily CyberSecurity
Iran-Linked "Password Spraying" Targets Municipal Response to Missile Strikes
Check Point Research uncovers an Iran-linked password spraying campaign targeting M365 to support kinetic missile strikes and damage assessment in the ME.
11 views
Daily Writeups
⤷ Title: Bug Bounty / Web Application Security Hunting Checklist - 2026 XSS Rat version
════════════════════════
𐀪 Author: Thexssrat
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:39:59 GMT
════════════════════════
⌗ Tags: #bug_bounty_hunter #bug_bounty_tips #bug_bounty #hacking #cybersecurity
Medium
Bug Bounty / Web Application Security Hunting Checklist
Bug Bounty / Web Application Security Hunting Checklist A practical checklist for web application security testing and bug bounty hunting. Work through each section methodically and expand the list …
12 views
Daily Writeups
⤷ Title: Hunting an Exposed ClickHouse Database — From Recon to Data Exfiltration
════════════════════════
𐀪 Author: Yadvesh yadav
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:12:21 GMT
════════════════════════
⌗ Tags: #bug_bounty #penetration_testing #data_security #ethical_hacking #cybersecurity
Medium
🔓 Hunting an Exposed ClickHouse Database — From Recon to Data Exfiltration
Introduction
24 views
Daily Writeups
⤷ Title: How a Simple GraphQL Query Exposed Facebook Page Admins and Their Personal Emails — A $15,000 Bug…
════════════════════════
𐀪 Author: Vivek PS
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:46:02 GMT
════════════════════════
⌗ Tags: #artificial_intelligence #hacking #cybersecurity #programming
Medium
How a Simple GraphQL Query Exposed Facebook Page Admins and Their Personal Emails — A $15,000 Bug Bounty Story -A Review of Philippe…
I made this writeup interactive! Experience this bug as a challenge on my platform Bug Story Quest — where you think like a hacker, not…
15 views
Daily Writeups
⤷ Title: CSRF Bypass via Missing Referer Header (PortSwigger Lab Walkthrough)
════════════════════════
𐀪 Author: PRiTi.EX
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:24:41 GMT
════════════════════════
⌗ Tags: #hacking #walkthrough #cybersecurity #portswigger_lab
Medium
CSRF Bypass via Missing Referer Header (PortSwigger Lab Walkthrough)
Today I solved a really interesting CSRF lab where the protection looked strong… but actually wasn’t
12 views
Daily Writeups
⤷ Title: كوريا الشمالية تضرب في عمق سلسلة التوريد والتمويل اللامركزي: كيف تحوّل الهجوم إلى سلاح استراتيجي؟
════════════════════════
𐀪 Author: Rynbsd
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:08:21 GMT
════════════════════════
⌗ Tags: #news #axios #hacking #cryptocurrency #npm
Medium
كوريا الشمالية تضرب في عمق سلسلة التوريد والتمويل اللامركزي: كيف تحوّل الهجوم إلى سلاح استراتيجي؟
285 مليون دولار من Drift في 12 دقيقة، وباب خلفي في مكتبة Axios تُنَزَّل 100 مليون مرة أسبوعيًا. كوريا الشمالية تعيد تعريف الحرب السيبرانية…
9 views
Daily Writeups
⤷ Title: Understanding CVE, CVSS and Real Security
════════════════════════
𐀪 Author: Little_Sun4lower
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 10:51:23 GMT
════════════════════════
⌗ Tags: #ethical_hacking #tech #vulnerability_management #cybersecurity #infosec
Medium
Understanding CVE, CVSS and Real Security
Software today runs almost everything banking apps, hospitals, airplanes, and even the coffee machines in offices.
19 views