Daily Writeups – Telegram
Daily Writeups
@Daily_Writeups
3.33K subscribers
1 photo
111K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.33K subscribers
Daily Writeups
⤷ Title: Double Compromise: Unearthing Unauthenticated SSRF and Weaponized XSS on Legacy Oracle…
════════════════════════
𐀪 Author: K4r33m
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 02:41:34 GMT
════════════════════════
⌗ Tags: #penetration_testing #bug_bounty #ssrf #cybersecurity #xs
Medium
Double Compromise: Unearthing Unauthenticated SSRF and Weaponized XSS on Legacy Oracle Infrastructure
When assessing enterprise perimeters, legacy subdomains often hide complex architectural flaws. During a recent engagement targeting a…
10 views
Daily Writeups
⤷ Title: Escalating a Duplicate Finding to a CVSS 10.0: Chaining Logic and Session Flaws for Persistent ATO
════════════════════════
𐀪 Author: K4r33m
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 02:27:02 GMT
════════════════════════
⌗ Tags: #session_misconfiguration #ato #bug_bounty #account_takeover #rate_limiting
Medium
Escalating a Duplicate Finding to a CVSS 10.0: Chaining Logic and Session Flaws for Persistent ATO
In bug bounty and penetration testing, a “duplicate” finding is often viewed as a dead end. However, a duplicate bug is essentially a known…
11 views
Daily Writeups
⤷ Title: ️How Anonymous LDAP Enumeration Led to AS-REP Roasting and Domain Compromise
════════════════════════
𐀪 Author: Jabaribrown
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 02:02:33 GMT
════════════════════════
⌗ Tags: #ctf_writeup #ethical_hacking #red_team #windows #hacking
Medium
🪟 💻🕷️How Anonymous LDAP Enumeration Led to AS-REP Roasting and Domain Compromise
As I continue preparing for the CRTP, I’ve begun incorporating external resources beyond the course material to strengthen my understanding…
7 views
Daily Writeups
⤷ Title: API Vulnerability Analysis in DVWA (Low to Impossible)
════════════════════════
𐀪 Author: Narathama Firmansyah Putra
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 01:00:57 GMT
════════════════════════
⌗ Tags: #dvwa #cybersecurity #api #penetration_testing
Medium
API Vulnerability Analysis in DVWA (Low to Impossible)
Introduction API (Application Programming Interface) adalah penghubung antara dua sistem agar bisa saling berkomunikasi. Secara sederhana…
10 views
Daily Writeups
⤷ Title: Love at First Breach 2026 — TryHackMe CTF Full Walkthrough
════════════════════════
𐀪 Author: Riddhi Sanghvi
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 02:37:27 GMT
════════════════════════
⌗ Tags: #ctf #web_exploitation #cybersecurity #ethical_hacking #tryhackme
Medium
Love at First Breach 2026 — TryHackMe CTF Full Walkthrough
A Valentine’s Day CTF packed with 10 real-world vulnerabilities across web exploitation, cryptography, AI security, and more.
11 views
Daily Writeups
⤷ Title: Practical OSINT techniques with Shodan leading to CVE
════════════════════════
𐀪 Author: Abhirup Konwar
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 02:21:08 GMT
════════════════════════
⌗ Tags: #red_teaming #ethical_hacking #iot_security #shodan #bug_bounty_tips
Medium
Practical OSINT techniques with Shodan leading to CVE
Smart Home IOT devices recon via Shodan Dorking
14 views
Daily Writeups
⤷ Title: Kali Linux
• Designed for professional penetration testing
• 600 plus preinstalled security…
════════════════════════
𐀪 Author: AB Siddiki
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 01:39:33 GMT
════════════════════════
⌗ Tags: #cybersecurity #kali_linux #parrot #ethical_hacking
Medium
🟢 Kali Linux • Designed for professional penetration testing • 600 plus preinstalled security…
🟢 Parrot OS • Focused on security, privacy, and daily use • Lightweight and fast, works well on low hardware • Built in anonymity and…
25 views
Daily Writeups
⤷ Title: After Feb 2026 Patches: Securing Async Django Apps Against New SQLi and Timing Attacks (Checklist +…
════════════════════════
𐀪 Author: Yogeshkrishnanseeniraj
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 02:28:28 GMT
════════════════════════
⌗ Tags: #async #sql_injection #cve #security #django
Medium
After Feb 2026 Patches: Securing Async Django Apps Against New SQLi and Timing Attacks (Checklist + Benchmarks)
The February 2026 Django security patches closed three high-severity vulnerabilities specific to async codebases. Here's the complete…
32 views
Daily Writeups
⤷ Title: Digital Terrorism in Oklahoma: Lucky Star Casino Chain Shuts Down as Tribes Refuse $700K Ransom
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:31:01 +0000
════════════════════════
⌗ Tags: #Malware #casino cyberattack #Cheyenne and Arapaho Tribes #digital forensics #Governor Reggie Wassana #Lucky Star Casino #Oklahoma gaming #ransom refusal #Rhysida ransomware #Tech News 2026 #tribal gaming security
Penetration Testing Tools
Digital Terrorism in Oklahoma: Lucky Star Casino Chain Shuts Down as Tribes Refuse $700K Ransom
Operations at one of the preeminent gaming establishments of the Cheyenne and Arapaho Tribes in Oklahoma, USA, have
31 views
Daily Writeups
⤷ Title: The Kill Switch for AI Agents: How Gen’s “Sage” Stops Autonomous Malware in Real-Time
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:29:37 +0000
════════════════════════
⌗ Tags: #Malware #Agentic Security #AI Agents #Claude Code #Command Injection #Cursor #Cybersecurity 2026 #Gen Sage #open source security #OpenClaw #Skill Scanner #supply chain attack #Typosquatting
Penetration Testing Tools
The Kill Switch for AI Agents: How Gen’s "Sage" Stops Autonomous Malware in Real-Time
AI agents are increasingly usurping tasks that formerly necessitated manual intervention: executing terminal commands, modifying repository files, managing
18 views
Daily Writeups
⤷ Title: The Fracture of Truth: How China’s Secretive Databases Are Outpacing the Ailing CVE System
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:26:54 +0000
════════════════════════
⌗ Tags: #Vulnerability #Bitsight #CNNVD #CNVD #CVE #Cyber Intelligence #National Security #NIST #NVD #RMSV regulations #Tech News 2026 #threat intelligence #Vulnerability Disclosure
Penetration Testing Tools
The Fracture of Truth: How China’s Secretive Databases Are Outpacing the Ailing CVE System
In the realm of information security, it has long been standard practice to categorize vulnerabilities via the CVE
13 views
Daily Writeups
⤷ Title: The IPTV Trap: How the “Massiv” Trojan Hijacks Government IDs and Empties Bank Accounts
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:25:09 +0000
════════════════════════
⌗ Tags: #Malware #accessibility services abuse #Android banking Trojan #Chave Móvel Digital #credential exfiltration #device hijacking #FuncVNC #gov.pt #IPTV fraud #Massiv malware #Southern Europe #Tech News 2026
Penetration Testing Tools
The IPTV Trap: How the "Massiv" Trojan Hijacks Government IDs and Empties Bank Accounts
A nascent Android banking Trojan has resurfaced, meticulously engineered to execute a recurring stratagem: coercing individuals into sideloading
13 views
Daily Writeups
⤷ Title: The “ClickFix” Trap: GrayCharlie Syndicate Hijacks U.S. Law Firm Sites in Sophisticated Supply-Chain Strike
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:24:25 +0000
════════════════════════
⌗ Tags: #Cybercriminals #ClickFix #fake browser updates #GrayCharlie #Insikt Group #legal sector cyberattack #NetSupport RAT #SMB Team #Stealc infostealer #supply chain attack #Tech News 2026 #WordPress Security
Penetration Testing Tools
The "ClickFix" Trap: GrayCharlie Syndicate Hijacks U.S. Law Firm Sites in Sophisticated Supply-Chain Strike
Experts from the Insikt Group division have promulgated the inaugural comprehensive dossier regarding GrayCharlie, a threat syndicate that,
13 views
Daily Writeups
⤷ Title: The Taxman’s Shadow: How a $2M Fraud Syndicate Impersonated Indonesia’s Official Coretax Service
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:21:39 +0000
════════════════════════
⌗ Tags: #Cybercriminals #accessibility services abuse #Android malware #Coretax Indonesia #DJP Online #Gigabud.RAT #GoldFactory #Group_IB #MMRat #Taotie Trojan #tax fraud 2026 #Vishing
Penetration Testing Tools
The Taxman’s Shadow: How a $2M Fraud Syndicate Impersonated Indonesia’s Official Coretax Service
In Indonesia, a sophisticated fraudulent enterprise has been unmasked, masquerading as the official Coretax fiscal service. Adversaries orchestrated
8 views
Daily Writeups
⤷ Title: The Silent Glitch: How a Single PayPal Coding Error Exposed SSNs for Six Months
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:19:12 +0000
════════════════════════
⌗ Tags: #Data Leak #coding error #credit monitoring #data breach #Equifax #Financial Security #identity theft #Paypal #PayPal Working Capital #SSN exposure #Tech News 2026
Penetration Testing Tools
The Silent Glitch: How a Single PayPal Coding Error Exposed SSNs for Six Months
The PayPal Working Capital lending service has sustained a significant data exposure, precipitated not by external adversaries, but
4 views
Daily Writeups
⤷ Title: The Mirror Trap: How the “Starkiller” Phishing Kit Proxies Real Sites to Neutralize MFA
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:17:30 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Credential Theft #Cybersecurity 2026 #Docker #headless Chrome #Jinkusu #MFA Bypass #PhaaS #Phishing_as_a_Service #reverse proxy #Session Hijacking #Starkiller
Penetration Testing Tools
The Mirror Trap: How the "Starkiller" Phishing Kit Proxies Real Sites to Neutralize MFA
A sophisticated new phishing instrument dubbed Starkiller has emerged within clandestine marketplaces, fundamentally altering the mechanics of credential
5 views
Daily Writeups
⤷ Title: The Trojan Coding Assistant: How a Compromised Token Pushed a Shadow Release of Cline
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:15:17 +0000
════════════════════════
⌗ Tags: #Malware #Cline CLI #GitHub Actions #npm security #OIDC #OpenClaw #package.json #software provenance #supply chain attack #Tech News 2026 #web shells
Penetration Testing Tools
The Trojan Coding Assistant: How a Compromised Token Pushed a Shadow Release of Cline
An incident has transpired within the npm registry involving the Cline CLI utility; for a duration of several
4 views
Daily Writeups
⤷ Title: Edge Fatigue: How Two 9.8 Zero-Days are Dismantling Ivanti’s Mobile Management Fleet
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:14:32 +0000
════════════════════════
⌗ Tags: #Vulnerability #CISA KEV #CVE_2026_1281 #CVE_2026_1340 #Cybersecurity 2026 #EPMM #Ivanti #Mobile Device Management #Palo Alto Networks #RCE #Unit 42 #zero_day
Penetration Testing Tools
Edge Fatigue: How Two 9.8 Zero-Days are Dismantling Ivanti’s Mobile Management Fleet
Two nascent zero-day vulnerabilities within the Ivanti mobile device management ecosystem are currently being exploited in live offensives,
11 views
Daily Writeups
⤷ Title: The Bitwise Blunder: How a Single Typo in Firefox’s Engine Opened the Door to RCE
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:11:44 +0000
════════════════════════
⌗ Tags: #Vulnerability #bug bounty #Cyber Security 2026 #Firefox #Garbage Collection #Ion JIT #JavaScript Engine #Mozilla #RCE #SpiderMonkey #Type Confusion #WebAssembly
Penetration Testing Tools
The Bitwise Blunder: How a Single Typo in Firefox’s Engine Opened the Door to RCE
A critical Remote Code Execution (RCE) vulnerability has been unearthed within SpiderMonkey, the JavaScript engine powering Mozilla Firefox.
13 views
Daily Writeups
⤷ Title: Beyond the Memory: How LSA Whisperer BOF Bypasses PPL and Credential Guard Without Touching LSASS
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 03:04:12 +0000
════════════════════════
⌗ Tags: #Open Source Tool #BOF #Cloud SSO #Cobalt Strike #Credential Guard #DPAPI #Kerberos #LSA Whisperer #LsaCallAuthenticationPackage #LSASS #Pentesting #PPL #red teaming #SpecterOps #Windows Security
Penetration Testing Tools
Beyond the Memory: How LSA Whisperer BOF Bypasses PPL and Credential Guard Without Touching LSASS
Interact with Kerberos and DPAPI without opening an LSASS handle. LSA Whisperer BOF uses official APIs to bypass PPL and Credential Guard during red teaming.
16 views
Daily Writeups
⤷ Title: Total Takeover Threat: Critical IceWarp Flaws Trigger Emergency Server Patches
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 04:27:41 +0000
════════════════════════
⌗ Tags: #Vulnerability #Arbitrary File Read #Cross_Site Scripting #Cyber Security #Enterprise Email #IceWarp #infosec #Patch Alert #security update #Server Security #XSS
Daily CyberSecurity
Total Takeover Threat: Critical IceWarp Flaws Trigger Emergency Server Patches
IceWarp urges immediate patching for critical flaws allowing unauthorized server access, XSS, and arbitrary file reading. Update your instances today.
18 views