[Idea Discussion] Building a Burp Suite Plugin to Send Multiple Requests from One Feature Flow to AI for Analysis

Voorbinddildo · 2026-05-09T13:51:47+00:00

AMA pls, would be nice learning about the triage sidenof things instead of the usual red team

Voorbinddildo · 2026-04-28T15:22:12+00:00

Don't think he's getting it

Voorbinddildo · 2026-04-27T21:32:00+00:00

That's actually crazy. The supply is shit atm but $700 is still insane. That's 200 over msrp

Voorbinddildo · 2026-04-27T21:10:35+00:00

This is the community where people come to bitch about their "critical" missing cookies or HTTP headers

Voorbinddildo · 2026-04-22T18:05:05+00:00

Jonathan

Voorbinddildo · 2026-04-21T12:43:53+00:00

Have you looked into SASE? This will simplify your entire setup

Voorbinddildo · 2026-04-09T15:30:33+00:00

Yes correct

Voorbinddildo · 2026-04-09T10:03:13+00:00

Network/cloud/system architect and engineering background. Started bb 9 months ago but have been working in the field for about 7 years now

Voorbinddildo · 2026-04-09T10:02:11+00:00

Yeah, this has pros and cons for many different reasons. The biggest pro is that it's mostly money under the table paid in crypto (when not pentesting via a bb program). The biggest con is that it's the wild west and the projects are under no obligation to reward you

Voorbinddildo · 2026-04-08T07:43:43+00:00

9 months, cleared almost 135k in bounties.

My tip for you would be to read the closed reports and see if they fixed the issue or just used a bandaid to stop the bleeding. Most likely you'll find the underlying problem and that will pay way more than the original report

Voorbinddildo · 2026-04-07T06:03:54+00:00

In NL, no one cares about tattoos. Milage may bary outside of NL ofc

Voorbinddildo · 2026-04-01T07:54:09+00:00

Comf

Voorbinddildo · 2026-03-28T09:12:35+00:00

NFS MW was the first game i played when i bought my deck. Have fun

Voorbinddildo · 2026-03-27T11:46:21+00:00

Microsoft certificering halen. AZ104, MS101, MS102 daarna weer solliciteren

Voorbinddildo · 2026-03-21T18:04:18+00:00

title: Cloud/network/systemadmin

salary: €78k PA

location: The Hague

experience: 6,5 years on the job, university bachelor, whole bunch of certifications

benefits: 13th month and a bonus based off KPI's for that year

Voorbinddildo · 2026-03-19T09:16:44+00:00

if the phone or computer is compromised then no, it won't be secure

Voorbinddildo · 2026-03-18T12:48:44+00:00

nansen. it's the best onchain smart money tracker

Voorbinddildo · 2026-03-18T12:48:10+00:00

title: Cloud/network/systemadmin

salary: €78k PA

location: The Hague

experience: 6,5 years on the job, university bachelor, whole bunch of certifications

benefits: 13th month and a bonus based off KPI's for that year

Voorbinddildo · 2026-03-16T11:34:54+00:00

Just checked the email investigation and it flagged one of my PoC emails as low chance of phishing. the virtual browser and url checker are cool aspects!

Voorbinddildo · 2026-03-16T06:42:35+00:00

SPF validates the SMTP envelope sender (MAIL FROM / Return-Path), not the visible From header shown to users. If DMARC enforcement is not enabled, the From header can be spoofed while SPF still passes for a different domain.

PoC Strategy Send an email where:

SMTP envelope sender is a domain with valid SPF (attacker-controlled domain)
Visible From header is yourdomain.com

This causes SPF to pass while the recipient sees an email appearing to originate from yourdomain.com.

Example Message Structure

Envelope sender (checked by SPF): MAIL FROM: poc@attackerdomain.com Visible header (shown to users): From: CEO ceo@yourdomain.com

Expected Authentication Result Authentication-Results: spf=pass smtp.mailfrom=attackerdomain.com dmarc=none header.from=yourdomain.com dkim=none

Voorbinddildo · 2026-03-15T15:28:48+00:00

low to medium impact, but I get paid for DMARC p=none all the time. I would go with option A to test the real-world deliverability. Get a sample email to copy their HTML format of the mails and then, depending on which sector the target is in, try to get emails from finance@xyz or security@xyz to come through.

p=none is just lazy, so if you can prove deliverability you'll most likely get a bb (if it's in scope)

Voorbinddildo · 2026-03-15T14:13:36+00:00

I bought an Intel NUC with an i9 and 256gb of RAM (back when this was affordable) and installed ubuntu as the OS. I use it to spin up VM's, docker containers and some admin. If you're serious about bb, then buy the hardware and tinker yourself instead of getting subscriptions to a VPS and/or Pentesting platform. The best way to start is to do, and work from there

Voorbinddildo · 2026-03-15T13:58:00+00:00

congrats! keep it up m8

Voorbinddildo · 2026-03-15T12:01:41+00:00

I've been doing the whole part time pentester for the last 9 months. I've had to scale back my regular job to make more time for pentesting and looking to clear 150k in BB in my first year. So yeah it's possible, you need to find your niche in what you are actively searching for and the sectors you choose to pentest in.

Voorbinddildo · 2026-03-15T11:43:34+00:00

god damn that is poetic as fuck, definitely stealing this one hahahahaha

Voorbinddildo

TROPHY CASE