MonkeHacks #77

I visited my relatives in Sendai last week, and now I’m back in Edinburgh after a peaceful flight back to Europe. The weather has taken an autumnal turn here, with temperatures hovering around 15°C / 60°F, and the city is being battered with spells of heavy rain. I’ve been waking up early due to jet lag - which hasn’t necessarily been a bad thing, because it’s making me more productive in the mornings. I’m going to make an effort to keep this sleep schedule intact. There’s a certain kind of peace that you can find in a slow, quiet morning routine.

Weekly Ideas / Notes 

• I’m back hacking, and this week I’ve been looking at a hacking challenge on Bugcrowd. The dupe period for the Google LHE in Mexico is approaching, so this is just something to fill my time before the main event of the month. Getting back into the rhythm of things has been a slow and steady effort. I think I still lack some degree of consistency in my hacking, some perseverance, and I’m trying to resolve that. I finished my slides for HackAIcon, so I’m glad to get that done nice and early before the deadline. That’s coming up in about 9 days (Sept 24-26) so I still have some more time to finalise preparations for that.

• I ordered an air fryer this week. All you need (if you’re me) is an air fryer, a blender and a rice cooker, really. You can cook most things with just those three appliances. I’m considering moving to a bigger flat here in Edinburgh because I don’t really have enough room in my current place, and it’s feeling a bit cramped. I’m not in any hurry, so I’m just browsing the rental market again and considering vibe-coding a script to alert myself on new postings across the various websites.

• I’ve signed up for guitar lessons - my plan is to get guitar lessons once a week. It’s not cheap but this is, I feel, an investment in myself. It’s something I really want to master. I’ve talked previously about trying to become a well-rounded person in terms of the arts as well, from languages to instruments, and this is part of my process to achieve that goal.

• Sometimes it’s a little difficult to see the point of these small changes or improvements that I make every few weeks. They don’t really feel like steps forward when you look at them individually. But when you compare the total changes I’ve made to where I was at the beginning of 2025, the difference is night-and-day. That’s why they’re so important.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (180/400 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

As rez0 always says, root for your friends! So this week I’ve included some recent articles by some friends of mine that I want to highlight. Not everyone uses X or has a large following, so these writeups can fly under the radar sometimes.

• HackerOne Introduces the New Hacker Milestone Rewards Program: It seems that HackerOne have revamped their milestone system in collaboration with Portswigger. The milestone rewards aren’t specified but it’s nice to see this system stated officially.

• Caido 101: Aituglo posted a nice succinct guide on using Caido.

• First Post by Synthetica: My good friend Wayne made his first blog post since getting into infosec. He’s a great guy, and his progress in the space is great to watch. I just want to shed some light on his journey :)

• Defcon & My First Talk: Roll4Combat, who I did a great sticker swap with at Def Con, has linked his Def Con slides in this article. It’s a nice mix of misconfiguration and good recon.

• Client-side RCE via CSS Injection in Google Web Designer for Windows: Balint, who has been on a streak of demolishing Google Web Designer, wrote yet another fantastic exploit to get RCE. I think a lot of people are sleeping on his work because he doesn’t use X; Balint is quietly doing some really nice work.