Daily Writeups
@Daily_Writeups
3.5K subscribers
2 photos
129K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.5K subscribers
Daily Writeups
⤷ Title: Upgrade Your Skills & Transform Your Future: Why IT Training is the Key to a Successful Career in…
════════════════════════
𐀪 Author: Swhizztechnlogies
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 13:19:22 GMT
════════════════════════
⌗ Tags: #java_fullstack_training #data_science_training #software_development #software_course_training #cybersecurity
Medium
Upgrade Your Skills & Transform Your Future: Why IT Training is the Key to a Successful Career in…
In today’s fast-evolving digital world, upgrading your skills is no longer optional — it is essential. Whether you are a student aiming to…
18 views
Daily Writeups
⤷ Title: Building a Cyber Security Portfolio — Learning Step 2: Learning to teach
════════════════════════
𐀪 Author: Randy Puffin
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 13:19:16 GMT
════════════════════════
⌗ Tags: #personal_growth #cybersecurity #portfolio #knowledge_retention #learning
Medium
Building a Cyber Security Portfolio — Learning Step 2: Learning to teach
One of the most difficult parts of learning, is getting it to stay in there. You can spend all day doom-scrolling information on Power…
9 views
Daily Writeups
⤷ Title: SPF, DKIM, and DMARC: the three protocols protecting your inbox (and why you need all of them)
════════════════════════
𐀪 Author: Red Sift
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 13:15:20 GMT
════════════════════════
⌗ Tags: #dkim #spf #dmarc #cybersecurity #email_authentication
Medium
SPF, DKIM, and DMARC: the three protocols protecting your inbox (and why you need all of them)
Email remains the backbone of business communication. It’s also the most exploited attack vector in cybersecurity, with over 90% of…
14 views
Daily Writeups
⤷ Title: The Importance of Online Security and How to Apply It
════════════════════════
𐀪 Author: Best Ecommerce Life
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 13:11:31 GMT
════════════════════════
⌗ Tags: #technology #digital_privacy #internet_safety #cybersecurity #online_security
Medium
The Importance of Online Security and How to Apply It
In today’s digital age, the internet is woven into nearly every aspect of our lives — from banking and shopping to education and…
14 views
Daily Writeups
⤷ Title: Building a Cyber Security Portfolio — Networking Step 2: Conferences
════════════════════════
𐀪 Author: Randy Puffin
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 13:02:17 GMT
════════════════════════
⌗ Tags: #social_media #personal_growth #meeting_people #cybersecurity #tech_conference
Medium
Building a Cyber Security Portfolio — Networking Step 2: Conferences
This week, I’m going to reveal one of the deepest secrets, one that eclipses many norms established in this age of online social spaces.
23 views
Daily Writeups
⤷ Title: Lposed module not working on android 16
════════════════════════
𐀪 Author: Jonsnow
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 13:45:49 GMT
════════════════════════
⌗ Tags: #magisk #android #mobile_penetration_test #mobile_security #penetration_testing
Medium
Lposed module not working on android 16
Complete Fix & Installation Guide
24 views
Daily Writeups
⤷ Title: eJPT v2 : Challenge Lab 26: Cheese
════════════════════════
𐀪 Author: Dhanushkumar R
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 12:56:35 GMT
════════════════════════
⌗ Tags: #cybersecurity #ctf #penetration_testing #security #tryhackme_walkthrough
Medium
eJPT v2 : Challenge Lab 26: Cheese
Introduction
35 views
Daily Writeups
⤷ Title: Understanding the Difference Between Penetration Testing and Red Teaming
════════════════════════
𐀪 Author: Beetles IO
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 12:09:13 GMT
════════════════════════
⌗ Tags: #redteam_tool #cybersecurity #red_teaming #penetration_testing
Medium
Understanding the Difference Between Penetration Testing and Red Teaming
In an era where cyberthreats are continually evolving, Businesses must adapt to new security measures. Penetration testing and red teaming…
50 views
Daily Writeups
⤷ Title: Detecting Web Attacks Walkthrough. TryHackMe
════════════════════════
𐀪 Author: Lintu Oommen
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 12:42:23 GMT
════════════════════════
⌗ Tags: #web_security #cybersecurity #tryhackme #wireshark
55 views
Daily Writeups
Forwarded from Bug Bounty Diary
✎ The perils of the “real” client IP & X-Forwarded-For Header

You've probably seen headers like these in common 403-bypass wordlists (e.g., my gist):
X-Forwarded-For: 127.0.0.1
X-Forwarded-Host: 127.0.0.1
X-Client-IP: 127.0.0.1

…and hundreds of similar variations (with 127.0.0.1, localhost, 192.168.1.1, internal IPs, etc.), but have you ever stopped to wonder why they sometimes actually work to bypass IP-based restrictions, rate limits, or 403/401 responses?

The answer lies in how unreliable and inconsistent the handling of "real client IP" headers is when a web application sits behind a reverse proxy (whether that’s a CDN like Cloudflare, an AWS ALB, a simple Nginx instance, etc.). It’s quite challenging for developers, because there’s no universal, standardized way for proxies to convey the original visitor’s IP to the backend and even less consensus on how the backend should parse and trust that information.

As a result, developers often rely on headers like X-Forwarded-For, X-Real-IP, or True-Client-IP to detect a visitor’s “real” IP address. But many frameworks use fragile logic especially the common pattern of trusting the left-most value in X-Forwarded-For. This is dangerous because the left-most entry is fully controlled by the client.

Cloudflare, AWS ALB, and many other proxies append the real IP to the header instead of overwriting it. So an attacker can send:
X-Forwarded-For: 127.0.0.1

and it becomes:
127.0.0.1, <real attacker IP>

Many libraries (like go-chi/httprate in Go) will mistakenly trust that spoofed first value. The app then believes the user is localhost or a trusted internal IP and may skip rate limits, authentication checks, or internal-only protections entirely.

This is not rare! dozens of frameworks and servers (Express, Jetty, IIS, Go libs, etc.) use inconsistent or insecure parsing strategies. The root problem: trusting client-controlled forwarding headers without restricting which proxies are allowed to set them.

• I summarized the blog, but I highly recommend reading the full article here: Article

#bugbounty #recon #HTTP #bypass
© t.iss.one/BugBounty_Diary
61 views
Daily Writeups
⤷ Title: Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices
════════════════════════
𐀪 Author: Unknown
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 21:05:00 +0530
════════════════════════
⌗ Tags: No_Tags
45 views
Daily Writeups
⤷ Title: Seraphic Becomes the First and Only Secure Enterprise Browser Solution to Protect Electron-Based Applications
════════════════════════
𐀪 Author: CyberNewswire
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:43:06 +0000
════════════════════════
⌗ Tags: #Press Release #Product Launch
Hackread
Seraphic Becomes the First and Only Secure Enterprise Browser Solution to Protect Electron-Based Applications
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
36 views
Daily Writeups
⤷ Title: Fortinet Issues Fixes as FortiWeb Takeover Flaw Sees Active Attacks
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:29:28 +0000
════════════════════════
⌗ Tags: #Security #CISA #Cyber Attack #Cybersecurity #Fortinet #FortiWeb #Vulnerability
Hackread
Fortinet Issues Fixes as FortiWeb Takeover Flaw Sees Active Attacks
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
21 views
Daily Writeups
⤷ Title: Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers
════════════════════════
𐀪 Author: CyberNewswire
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 14:01:15 +0000
════════════════════════
⌗ Tags: #Press Release #Breach and Attack #CISO #Monitoring #Report #Research
Hackread
Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
31 views
Daily Writeups
⤷ Title: MSQP: An MySQL privilege escalation tool
════════════════════════
𐀪 Author: Мартин.
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:56:05 GMT
════════════════════════
⌗ Tags: #linux #hacking #mysql #security #pentesting
Medium
MSQP: An MySQL privilege escalation tool
Visit: https://github.com/MartinxMax/MSQP
30 views
Daily Writeups
⤷ Title: Why the idea of AI fighting AI in cybersecurity is a dangerous myth.
════════════════════════
𐀪 Author: Abatis ABTU
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:32:45 GMT
════════════════════════
⌗ Tags: #cybersecurity #future_of_work #infosec #artificial_intelligence #technology
Medium
Why the idea of AI fighting AI in cybersecurity is a dangerous myth.
The narrative that the only answer to AI driven attacks is more defensive AI is becoming common. It sounds plausible. If attackers automate…
22 views
Daily Writeups
⤷ Title: The First Fully AI-Led Cyberattack Has Arrived
════════════════════════
𐀪 Author: Juan M. Vazquez
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:41:17 GMT
════════════════════════
⌗ Tags: #chatgpt #artificial_intelligence #ai #claude #cybersecurity
Medium
The First Fully AI-Led Cyberattack Has Arrived
And It Changes Everything
13 views
Daily Writeups
⤷ Title: Why EU Administrations Still Seal Official Letters on Paper
════════════════════════
𐀪 Author: Letro
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:40:11 GMT
════════════════════════
⌗ Tags: #cybersecurity #communication #data_protection #legal_technology #digital_transformation
Medium
Why EU Administrations Still Seal Official Letters on Paper
Across Europe, the official letter remains the default instrument for notices, decisions, and service of rights.
15 views
Daily Writeups
⤷ Title: The Day AI Stopped Knocking and Started Kicking Down the Door
════════════════════════
𐀪 Author: Earnest Sherrill
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:38:42 GMT
════════════════════════
⌗ Tags: #technology #ai #cybersecurity #entrepreneurship #self_improvement
Medium
The Day AI Stopped Knocking and Started Kicking Down the Door
The first time I realized the world had shifted, it wasn’t on the news. It wasn’t some breaking alert or government announcement.  It was…
15 views
Daily Writeups
⤷ Title: The Day the Internet Blinked: Why Half the Web Went Dark Yesterday
════════════════════════
𐀪 Author: Tomas Monka
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:36:45 GMT
════════════════════════
⌗ Tags: #internet_outage #gemini_3 #cybersecurity #cloudflare #technology
Medium
The Day the Internet Blinked: Why Half the Web Went Dark Yesterday
Was it a cyberattack? A rogue AI? Or just a really bad typo? Here is what actually happened during the Cloudflare outage of Nov 18.
31 views
Daily Writeups
⤷ Title: What Ethical Hackers Actually Do (and What They Don’t Do)
════════════════════════
𐀪 Author: Nur_nayeem
════════════════════════
ⴵ Time: Wed, 19 Nov 2025 15:27:52 GMT
════════════════════════
⌗ Tags: #ethics #ethical_hacking #cybersecurity #hacker #white_hat_hacker
Medium
What Ethical Hackers Actually Do (and What They Don’t Do)
SDG:4 (Education)
12 views