Visual recon with Aquatone and WebScreenshot
A VPS-based workflow chaining Aquatone subdomain discovery, WebScreenshot capture and express-photo-gallery into a browsable wall of screenshots for triaging a large attack surface.
Subdomain enumeration
Working out which hosts a company actually runs, which is never the list they think it is.
2018
2016
.htpasswd exposed, DES hash cracked
Directory brute-forcing a private bug bounty target turned up a world-readable .htpasswd whose descrypt hash, once cracked, opened four staging and development subdomains.
2014
Seven PayPal Bugs, Zero Bounties
A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid.