March 2025 Summaries

The author of the text is a hacker who uses large language models (LLMs) to augment their offensive security work. They explore ways to harness AI agents for hacking purposes, focusing on building effective agents from scratch and using existing tools like nerve and robopages to simplify the process. The author emphasizes the importance of tasking agents properly and structuring workflows to maximize their effectiveness. They demonstrate the use of LLMs in reconnaissance, payload creation, and report writing, showcasing the potential of AI-powered hacking assistants. The text concludes by highlighting the benefits of learning about LLMs and machine learning concepts for hackers looking to stay ahead of evolving defenses and maximize their impact.

RCE is a type of attack that enables an attacker to execute arbitrary commands on a target machine, potentially gaining total control over the system and accessing sensitive data. There are numerous ways to achieve RCE, including unrestricted file uploads, command injection, SQL injection, XML external entity (XXE) attacks, server-side template injection (SSTI), and server-side request forgery (SSRF). To identify potential entry points for code execution, it's essential to understand the web application's functionality, context is key, and testing every potentially vulnerable endpoint or service is crucial. The author of this article successfully exploited a critical vulnerability in Adobe Experience Manager by bypassing the AEM Dispatcher and executing arbitrary commands using GroovyConsole, demonstrating the capabilities of RCE. Understanding server-side issues, enumeration, and thinking like an attacker are essential takeaways from this experience, and it's recommended to check out expert presentations on exploiting different image processors and finding impactful bugs.

The cybersecurity industry is witnessing a significant shift with the emergence of AI-driven security testing tools, promising to transform human-led testing by introducing automated adversarial simulations. These tools are evolving rapidly, pushing beyond simple vulnerability scanning and applying machine learning models to identify novel attack paths and chain exploits dynamically. However, while AI shows impressive potential, it also comes with limitations and risks, particularly when compared to the ingenuity, adaptability, and strategic thinking of human security professionals. Experts emphasize that AI is a powerful tool for automation, but not a replacement for human expertise. AI can streamline penetration testing by automating repetitive tasks like vulnerability scanning, exploit code generation, and reconnaissance, reducing manual labor and allowing testers to focus on complex analytical challenges. However, AI struggles with understanding context and nuance, particularly in complex web applications where human intuition is required. Over-reliance on AI can lead to false positives and false negatives, potentially undermining security assessments, while ethical concerns arise regarding the boundaries of automation in cybersecurity. The future of AI in security testing lies in synergy between human expertise and AI-driven efficiency, with a focus on integrating AI-powered signal processing, human-guided AI testing, crowdsourced adaptability, and empowering researchers to drive better security outcomes. Ultimately, the reality is that attackers are constantly innovating, and the best defense relies on AI-assisted humans who can think like attackers and stay ahead of the curve.

The rapid evolution of general-purpose AI (GPAI) systems has brought significant advancements but also high risks, including flaws in outputs and systemic vulnerabilities. To address these issues, the AI community must prioritize the needs of third-party researchers and hackers who uncover flaws, proposing actionable solutions such as standardized protections for researchers, robust reporting infrastructure, and coordinated disclosure mechanisms. Drawing from lessons in software security, a safe harbor framework is essential to empower researchers while enabling organizations to address flaws responsibly, addressing unique challenges such as opaque AI systems with complex supply chains. The proposed framework includes clear rules of engagement, liability protections, and standardized reporting processes to ensure flaws are addressed without exposing researchers to undue risk, utilizing existing platforms like Disclose.io and Bugcrowd as a foundation for building the infrastructure for AI flaw reporting.

Bugcrowd is launching the hackHER Network, a women-only hacker community designed to create a space for women in cybersecurity to connect, collaborate, and grow together. The initiative aims to break down barriers in the industry, which remains largely male-dominated, and unlock untapped talent and innovation. By providing mentorship, skill-building workshops, career development opportunities, and support, Bugcrowd hopes to empower more women to succeed in the field of cybersecurity. The community is open to women of all ages and identities, including cis, trans, and nonbinary individuals, and offers a range of benefits, including continuous mentorship, hands-on challenges, public recognition, strategic partnerships, and access to a private Discord channel. Membership is free and flexible, allowing participants to come and go as they please, and the community is open to women who identify as female, regardless of age or identity.

Security leaders remain concerned about data breaches, with the global cost of cybercrime projected to reach $10.5 trillion annually by 2025. To address this threat landscape, software security teams employ proactive security approaches like penetration testing and red teaming. Penetration testing is a security assessment method where human testers examine systems for vulnerabilities against a predetermined methodology, usually for compliance with internal or external controls. Red team engagements involve simulating real-world attacks against an organization's technology, people, and processes, typically lasting 2-4 weeks for targeted assessments and 1.5-6 months for full-scale assessments. Both approaches offer benefits, including coverage, cost-effectiveness, and providing stakeholder reassurance, making them valuable tools in improving security posture. Red teaming accelerates an organization's security testing by identifying critical attack paths that cause the most damage, typically resulting in a 25% reduction in security incidents and a 35% reduction in the cost of security incidents. Combining penetration testing with red team engagements elevates security maturity by providing a comprehensive approach to securing systems against common and sophisticated vulnerabilities.

The Bugcrowd Code of Conduct (CoC) is a set of guidelines that outlines the expectations for hackers working on the platform. Adhering to the CoC is crucial for success, as it ensures that hacking efforts are conducted ethically and professionally. The CoC emphasizes respect for engagement scope, responsible disclosure, no exploitation, and avoiding disruptive behavior. Common violations include spamming support, submitting multiple tickets for the same issue, using unprofessional language, and failing to follow submission processes. By following the CoC, hackers can build trust, reputation, and community, while also earning better rewards and opportunities for collaboration with prestigious security teams and industry leaders. The CoC is essential for maintaining a safe and professional hacking environment, where hackers can elevate their craft through integrity and shared commitment to improving cybersecurity systems.

Device code authentication was designed to provide seamless authentication for devices lacking standard login interfaces. However, this flow does not inherently tie authentication to a specific device, making it an attractive target for attackers who can extract access and refresh tokens through social engineering, allowing long-term access to accounts without needing to interact with the victim's device directly. Device code phishing exploits this vulnerability by tricking victims into entering a device code on a legitimate Microsoft authentication page, which can then be used to bypass multi-factor authentication requirements. Attackers use tools like TokenTactics to generate device codes and craft phishing lures that appear legitimate, often impersonating IT support or Microsoft Teams meetings. Once the victim enters the code, they are prompted to authenticate using their actual credentials and MFA, after which attackers intercept these tokens and can gain unauthorized access to the victim's Microsoft 365 environment. To protect against device code phishing, organizations should restrict or disable device code authentication where possible, implement conditional access policies and risk-based authentication, enhance detection and response to token theft, strengthen user awareness and phishing training, and harden email security and threat intelligence capabilities.

The author, an ethical hacker, reviews the Netflix series Zero Day with a critical eye as someone who works with Bugcrowd to find and fix vulnerabilities in software and systems. While the show's depiction of a massive-scale zero-day attack was unrealistic, the author notes that individual attacks are possible, especially if hackers target remote code execution or command and control systems. The author also highlights how convenience and data sharing can lead to security challenges, such as devices being vulnerable to hacking due to lack of proper inspection or backdoor threats. Ultimately, while a massive-scale attack like in Zero Day is unlikely, the author believes that advanced threat actors with insider help could make it happen, and that AI will play a significant role in future attacks.

The US government has significantly adopted Vulnerability Disclosure Programs (VDPs) through initiatives like Hack the Pentagon and DHS/OMB's BOD 20-01, demonstrating tangible benefits of collaboration with ethical hackers. These programs have guided agencies toward proactive vulnerability management, creating industry-wide ripple effects. A new bill, H.R. 872, The Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025, has garnered bipartisan support and mandates VDP adoption through DFARS procurement requirements, ensuring comprehensive adoption once enacted. This requirement will create powerful motivation for businesses to adopt standardized processes, leveraging guidelines like NIST and ISO 29147/30111, to simplify compliance and remain competitive in federal contracting. The bill's passage is seen as a vital step in promoting the role of good-faith security research in cybersecurity, fostering deeper collaboration between ethical hackers and traditional security teams, with organizations looking to proactively incorporate vulnerability disclosure into their security strategy.

The Secure by Design (SBD) pledge is a voluntary initiative launched by the Cybersecurity and Infrastructure Security Agency (CISA) in May 2024, aiming to improve software security. The pledge asks enterprise software vendors to make measurable progress across seven security goals within a year, including increasing multi-factor authentication use, reducing default passwords, and improving vulnerability disclosure. While the pledge is commendable, its impact six months in has been limited due to a lack of transparency and accountability from some signatories. However, companies like Tenable, Trend Micro, and Google have demonstrated progress by sharing their achievements and challenges publicly. To sustain and amplify the SBD movement, it's essential to formalize transparency, expand the pledge to cloud infrastructure and IoT devices, consider incentives and regulation, and provide solutions to support companies in meeting SBD's requirements.

The Bugcrowd College Program supports university students in cybersecurity through various initiatives, including a hands-on hardware hacking demonstration led by Erik de Jong. The event aimed to provide students with new skills and experience in hardware hacking, focusing on techniques such as PCB reverse engineering, flash memory dumping, and soldering. By partnering with the University of New Brunswick Cybersec club, Bugcrowd successfully fostered an opportunity for students to learn from a top hacker and gain hands-on experience in hardware hacking. The event's success marked a new chapter in the program's efforts to expand its offerings and provide students with practical skills in this field.