June 2025 Summaries

Caido is a web security toolkit designed by hackers for hackers, offering a comprehensive suite of features tailored to penetration testers, bug bounty hunters, and security professionals. Developed by a small team with guidance from experts like Ben Sadeghipour and Justin Gardner, Caido facilitates the identification of web application vulnerabilities through its intuitive interface and customizable extensions in familiar languages like HTML, CSS, and JavaScript. It functions as a proxy server, allowing users to intercept, modify, and automate HTTP requests and responses, essentially enabling them to manipulate web traffic to uncover security flaws. The platform is budget-friendly, offering a free tier with unlimited installations and additional premium features, such as an AI-powered assistant, for subscribers. Caido also supports community-driven development, enabling users to share and download extensions and plugins, enhancing its capabilities. Its design aims to make security testing accessible and efficient, accommodating both seasoned professionals and beginners, with educational support for students pursuing higher education.

The blog offers insights from cybersecurity experts Julian Brownlow Davies and Trey Ford, providing practical advice for those looking to enter the field of cybersecurity. It emphasizes the importance of identifying a suitable entry point based on one's interests and strengths, such as bug bounty programs, which require no prior experience and offer a platform to demonstrate real-world skills. The blog advises against accumulating numerous certifications without direction, suggesting that practical experience and demonstrating skills in real-world scenarios can be more valuable. It highlights the potential to leverage transferable skills from non-cyber backgrounds, such as communication, risk management, and educational skills, to succeed in cybersecurity roles. Additionally, it encourages individuals to choose educational paths that align with their preferred learning styles, whether through formal education, bootcamps, or self-paced platforms, and stresses the importance of building a public track record of skills through participation in bug bounty and vulnerability disclosure programs.

In 2024, a significant partnership between Bugcrowd and Hack the Box flourished, focusing on enhancing cybersecurity skills through student development and industry-relevant training. The collaboration continued into 2025 with the introduction of Capture the Flag (CTF) events, designed to upskill participants and guide them into the bug bounty sector. These events provided participants with unique opportunities on the Bugcrowd Platform, exclusive merchandise, and a chance to compete in the November finale of 2025. To qualify, participants must be top earners or submitters on the Bugcrowd platform, with specific criteria such as non-duplicated valid submissions and account creation requirements. The initiative aims to expand opportunities for future cybersecurity professionals, with applications open until July 15th, and notifications sent by October 15th, supporting the journeys of aspiring ethical hackers and cybersecurity experts.

Recent threats to U.S. critical infrastructure have sparked increased concern in the security community, prompting insights from Bugcrowd's leadership on the importance of resilience over fear. The Department of Homeland Security and the New York Department of Financial Services have issued warnings that highlight existing vulnerabilities, urging organizations to evaluate their infrastructure, especially in collaboration with third-party partners, and to maintain up-to-date incident response plans. Focused attention is needed on foundational security weaknesses within systems like OT, ICS, and SCADA, particularly regarding easily exploitable vulnerabilities such as default credentials and publicly addressable infrastructure. Additionally, the increasing threat of AI-generated misinformation calls for careful verification of online information to prevent the spread of false narratives. The situation provides an opportunity to reinforce security measures, adopt defense-in-depth strategies, and ensure the security of supply chains. Organizations are encouraged to proactively address vulnerabilities and seek expert guidance if uncertainties about their security posture remain.

Mobile application security is becoming increasingly important as mobile traffic surpasses desktop usage, yet many organizations still overlook it. The Mobile Hacking Resource Kit offers a comprehensive guide with blogs, videos, courses, and tools for iOS and Android penetration testing, aimed at helping security professionals enhance their skills. This kit includes resources for reverse engineering, dynamic instrumentation, and vulnerability scanning with tools like Burp Suite, Frida, and mitmproxy. Additionally, artificial intelligence (AI) and language learning models (LLMs) are being integrated into penetration testing to automate tasks, simulate advanced threats, and improve phishing tactics, although they also raise concerns about data privacy. To stay ahead, ethical hackers should combine traditional tools with AI advancements, leveraging resources such as the Bugcrowd Mobile Hacking Resource Kit while maintaining robust data governance practices.

In May 2025, a vulnerability identified as CVE-2025-0133 was reported by XBOW, concerning the GlobalProtect VPN client gateway by Palo Alto Networks. This vulnerability, which is relatively easy to exploit, allows unauthorized third-party contractors access to applications and networks without needing complex attacks, as it can be triggered by simply misleading an end-user to click a manipulated link. Bugcrowd has noted a significant number of these vulnerabilities being reported, indicating its widespread presence and substantial impact. In a detailed security flash, Bugcrowd's founder, Casey Ellis, and Sr. Manager of Security Operations, Von Tran, delve into the implications for both defenders and attackers, as well as the broader context of AI and automation in relation to this security issue.

UARTs are a common interface in embedded hardware and can be used to access an interactive root shell on devices running Linux. UART connectors typically have four pins: VCC, GND, RX, and TX, which can be identified by looking for the 4-pin connector on the circuit board or using a logic analyzer to distinguish between each line. UARTs often use test points, which are soldered pads that can be used to test the interface without a matching test bed. To enumerate a UART, one needs to find the ground pin and set up a logic analyzer, then measure the digital signal and identify the baud rate. Once connected to the UART using a TTL serial adapter, one can access the console output on their PC and interact with the device. The author is a professional security researcher who has been working in the field for over 20 years and has published multiple CVEs.

Red Team as a Service (RTaaS) has been launched to help organizations build red teams and improve their security postures. However, there are misconceptions about what makes an effective red team engagement, such as relying on frameworks or best practices without adapting to novel attack vectors, using pre-existing tools without customization, and not leveraging OPSEC awareness. To effectively use red teaming, organizations should design their engagement, evaluate red teamers, and act on the results. RTaaS can simplify the implementation and scaling of red team exercises, providing a simple process, vetted operators with hustle and OPSEC-awareness, and in-depth, actionable reports. Organizations that treat red teaming as a one-off instead of an evolving program, and CISOs who are actively involved in reviewing and acting on red team findings, can fully leverage the exercise's outcomes to drive security results.

The text discusses the use of a library called Rigging to build and test AI-powered applications, particularly in the context of artificial intelligence security. The author, Ads Dawson, shares their experience with leveraging agents, crafting exploits, and mining the hidden gems of AI security using Rigging. They provide a step-by-step guide on how to build a bare-bones Rigging agent to tackle AI hacking challenges on Crucible's platform, which includes exploring real-world LLM applications and testing attack surfaces. The author highlights the flexibility and extensibility of Rigging, its ability to integrate with various libraries and tools, and its focus on higher-level abstractions like pipelines and tools. They also demonstrate how to use Rigging in a simple chat example, showcasing its ease of use and versatility. Additionally, they discuss the importance of tracing and logging in AI systems, using Pydantic's Logfire for seamless web view integration, and provide examples of how to use Rigging to extract flags from chatbots. The text concludes with Ads' plans to continue exploring Rigging and other AI-related topics, sharing their content on LinkedIn, GitHub, and other platforms.

Hacking crypto in hardware devices poses unique challenges, including securing firmware updates, authentication and authorization, and cryptographic key management. Side-channel attacks exploit unintended information leaks from a system, such as power consumption or electromagnetic emissions, to extract sensitive information. These attacks can be performed with minimal tools, making them accessible to bug bounty hunters new to hardware hacking. DPA is generally more complex but can yield impressive results with the right tools and persistence. Hardcoded encryption keys in firmware are vulnerable to extraction through reverse engineering and memory analysis, which can be done using various tools like binwalk, IDA Pro, and Ghidra. Fault injection attacks involve disrupting a device's operation to force it into an exploitable state, such as voltage glitching or electromagnetic fault injection. Unprotected debug interfaces like JTAG and UART provide opportunities for juicy findings, while insecure firmware and software updates enable rollback attacks and backdoors. Devices without proper cryptographic authentication are vulnerable to replay attacks and spoofing, making them susceptible to unauthorized access and data modification. Real-world examples include the Trezor One vulnerability, Ring doorbell hack, Medtronic insulin pump vulnerabilities, Juniper Dual_EC_DRBG backdoor, and gas station controller weaknesses.

Bugcrowd has developed a proprietary service called Red Team as a Service (RTaaS) that harmonizes the thoroughness of red teams and the flexibility of crowdsourced testing. This industry-first model helps companies find the right red team for their needs, providing them with a flexible and scalable solution to stay ahead of real-world attacks. Bugcrowd's RTaaS offering is built on a rigorous process that identifies and selects the best red team operators, ensuring customers get a thorough and efficient assessment. The service offers three tiers of engagement options: Assured, Blended, and Continuous, allowing companies to choose the level of flexibility they need. With its global pool of vetted red teamers and multitiered options, Bugcrowd's RTaaS provides customers with confidence in their security posture while minimizing costs.

Bolt, a European shared mobility platform with over 200 million lifetime customers across 50 countries and 600 cities in Europe and Africa, has launched a public bug bounty program to tap into the collective intelligence of the global hacker community. The move aims to enhance the safety and reliability of its shared mobility platform by leveraging the expertise of hackers. Bolt partnered with Bugcrowd almost five years ago to address key security challenges such as initial triaging capabilities, outreach to capable hackers, and managing submissions. Since implementing a private bug bounty engagement, Bolt has experienced benefits including improved communication between teams, efficient payouts, and enhanced security posture. The partnership has also led to tangible business benefits, including reduced risk and the identification of important vulnerabilities before they could be exploited in the wild. As Bolt takes its program public, it aims to attract high-quality hackers, refine its program, and increase visibility to ensure all critical security issues are reported easily.