// things nobody tells you
Field notes
Small pieces of hard-won knowledge that save hours, find bugs others miss, and keep you professional. Some you will use today. Some you did not know you needed.
- 0x01beginner
The browser is a suggestion
Client-side validation, disabled buttons, and hidden fields are UX, not security. Anything the browser sends, you can change in Burp Repeater.
- 0x02beginner
Copy as cURL
Right-click any request in browser devtools, Network tab, and choose Copy as cURL. You now have a replayable, scriptable request with every header and cookie.
- 0x03beginner
CyberChef Magic
Paste unknown data into CyberChef and run the Magic operation. It detects layered encodings like Base64 inside hex inside gzip automatically.
- 0x04beginner
Scan all 65,535 ports
Default Nmap checks only the top 1,000 ports. Admins hide services on high ports, so run -p- first, then deep-scan only what is open.
- 0x05intermediate
Certificate Transparency leaks subdomains
Every public TLS certificate is logged forever. crt.sh reveals dev, staging, and internal hostnames companies never meant to advertise.
- 0x06intermediate
Old API versions still answer
If the app calls /api/v3, try /api/v1. Deprecated versions are often still routed and miss newer authorization checks.
- 0x07intermediate
Localhost-only services
Once you are on a box, ss -tulpn shows services bound to 127.0.0.1 that no external scan could ever see. Databases and admin panels hide here.
- 0x08intermediate
Timestamp your prompt
Put the date and time in your shell prompt and log sessions with script. When a client asks what you ran at 14:32, you will have the answer.
- 0x09intermediate
Mobile apps talk to different APIs
Mobile clients often hit older or separate endpoints than the website. Proxy the app and you may find an entirely different attack surface.
- 0x0aseasoned
Valid credentials are the quietest attack
Defenders catch exploits far better than logins that look legitimate. Test MFA, conditional access, and anomaly detection, not just vulnerabilities.
- 0x0bseasoned
Cloud IPs get recycled
Re-resolve hostnames during long engagements. A cloud IP that belonged to your client yesterday may belong to someone else today.
- 0x0cseasoned
Fix the class, not the bug
Remediation that says use parameterized queries in the data layer prevents the next ten bugs. Escape this parameter fixes one.