PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Byte-ful with TomNomNom

bugcrowd.com | blog | #bug-bounty | #burp-suite | #security-tools | #bugcrowd | #interview | #tooling | #podcast | #hacker-advice | #hakluke | #tomnomnom
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd's hakluke interviews TomNomNom about bug bounty, rapid tool-writing, favorite resources, and lessons for newcomers, including why he'd write his tools earlier and learn Burp Suite sooner.
Published
Collected

Related coverage

blog · netlas.io
7 Tools for Web Penetration Testing
Guide to web app pentesting: the standard testing steps, then seven tools—Netlas, Nmap, Arachni, W3af, Nessus, Burp Suite and SQLmap—with descriptions, pros/cons and usage examples.
blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
blog · bugcrowd.com
Behind the scenes of PHP2Shell: What the last 72 hours taught us
PHP2Shell hit fast. Bugcrowd’s CISO shares what 72 hours of response taught us, plus three lessons for CISOs facing the next critical vulnerability.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
blog · bugcrowd.com
Weird ways to hide shellcode
Discover a novel red teaming technique for hiding shellcode inside procedurally generated mazes, using shortest-path algorithms to disguise payloads from EDR and antivirus detection.
Back