Unlinked infra + open storage + leaked secrets.

0:00–0:15 Dangling types + fingerprint idea (CNAME/NS/MX/A)

Write 4 types + dig CNAME + NXDOMAIN/404 proof shape. Read Can-I-Take-Over-XYZ fingerprints.json — S3 + CloudFront + Heroku + Azure + Fastly rows ONLY.

0:15–1:05 30+ fingerprints + nuclei takeovers + subzy (scope, no claim)

Study 30+ service fingerprints (response strings) + dry-run nuclei -u hosts.txt -t http/takeovers/ -o take.txt + subzy run --targets subs.txt --hide_fails --vuln on SCOPE ONLY (no claiming). THM takeover Task 2–4 (gobuster vhost, blog/support clues, claim THEORY) ONLY.

1:05–2:00 resources.hackerone $500 + CloudFront Grab + Smule SendGrid

Read hacktivity subdomain takeover (resources.* $500 pattern) + CloudFront/Grab CNAME-claim PoC + H1 #2567048 Smule (claim to mark busy) — CNAME + fingerprint + benign-fix ONLY each.

2:00–2:35 Dangling list + responsible-claim procedure card

Write card: verify → screenshot dig+body → benign file → impact (cookie/session/sibling scope) → report. No destructive content, no cert abuse beyond proof.

2:35–3:00 Dangling-types test + gaps

Recite 4 + proof shape. Triage gaps (buckets next).

0:00–0:15 List vs read vs write + policy shapes

Define ListBucketResult vs GetObject vs PutObject + BucketRegionalDomainName. Read HackTricks S3 unauthenticated-enum § list/read/write ONLY.

0:15–1:05 cloud_enum + naming permutes + Firebase .json (in-scope)

Run cloud_enum -k target -m s3,gcs,azure -l mutations.txt IN-SCOPE ONLY + https://app.firebaseio.com/.json rules check (GET only). THM awshacking101 Task 2 (S3) ONLY (lab). YT: S3 bucket misconfiguration bug bounty poc.

1:05–2:00 Open Presto $5k + Eureka $500 + S3 write-test rule

Read hacktivity Presto open-dashboard $5k pattern (:8889 no-auth queries) + Eureka :8761 info-disclosure $500 pattern — port + proof ONLY each. Rule: write-test = PUT poc.txt then DELETE, only if policy explicitly allows + scope permits; else list-only + report.

2:00–2:35 Bucket checklist + data-minimization + stop rule

Write checklist (permute → list → policy → sample-one → stop). One file sample max, redact, no bulk download.

2:35–3:00 List-vs-read test + gaps

Explain with XML markers. Triage gaps (IAM next).

0:00–0:15 IMDSv1/v2 + task-role + policy-eval basics

Recap Week-08 v1/v2 + ECS task-role endpoint + role-name → creds → s3 ls order. Read HackTricks AWS security index § metadata ONLY.

0:15–1:05 Role-cred → privilege check (lab) + over-permissive patterns

On LAB SSRF: fetch role-name → creds → aws s3 ls read-only (lab). Note *:* policies (flag, don't use). THM awshacking101 Task 3–4 (IAM + EC2 metadata) ONLY (lab). YT: SSRF to AWS metadata IAM takeover lab.

1:05–2:00 SSRF→IAM→s3-ls chain + flaws.cloud walkthrough

Do flaws.cloud (first 3 levels, own env) + flaws2.cloud intro — chain order ONLY. Read 1 SSRF→IAM→s3-ls writeup — credential-handling + stop point ONLY.

2:00–2:35 Cred rotation + severity + 24h rule

Write rotation note (keys rotate — report fast) + severity (role-name vs full creds) + 24h card.

2:35–3:00 Task-role test + gaps

Explain ECS task-role vs EC2 role. Triage gaps (supply next).

0:00–0:15 Dork operators + confusion/typosquat mechanics

Write org: filename:.env AKIA + confusion (private name → public claim) + typosquat (lodahs). Read OWASP supply-chain failures § confusion/typosquat ONLY.

0:15–1:05 Org dorks + SBOM/lockfile review (public, read-only)

Run dorks (read-only). Review package-lock.json/requirements.txt/Gemfile.lock + package.json deps (versions → KEV match, no install). Dry-run trufflehog github --org=X --only-verified + gitleaks detect on TEST data ONLY.

1:05–2:00 GitHub-secret full-access + confusion-RCE note (read, no publish)

Read 1 Grab-pattern secret full-access (key → read-only validation) + 1 confusion-RCE note (npm view <private-name> existence check ONLY, never publish).

2:00–2:35 No-publish rule card + namespace-squat check (safe)

Write card + check npm view for 3 private names (existence only). Review postinstall scripts by READING (no execution).

2:35–3:00 Confusion-mechanics test + gaps

Explain confusion vs typosquat with registry order. Triage gaps (OSINT next).

0:00–0:15 Pivot types: WHOIS/DMARC/CSP/favicon/JARM/ASN

List 6 + query shape each. Read HackTricks External Recon § pivot rows ONLY + Censys docs hosts/certs syntax + Shodan filters/docs headings ONLY.

0:15–1:05 Sibling + alt-TLD + cert-org + favicon-hash on 1 org (passive)

Pivot reverse-WHOIS + DMARC + CSP report-uri hosts + http.favicon.hash: + JARM (passive queries, no scan). THM redteamrecon Task 3–6 (advanced/search-engines/recon-ng/maltego) + THM shodan Task 1–3 (what/filters/CLI) ONLY. YT: shodan censys subdomain enumeration bug bounty.

1:05–2:00 Sibling-RCE via shared infra + favicon-pivot cases

Read 1 sibling-RCE (shared cookie/session/infra) + 1 favicon-hash infra-find — pivot query + shared surface ONLY each.

2:00–2:35 ASN expand + favicon hashes + reverse-CSP note

Consolidate ranges + hashes + CSP-discovered hosts into infra map.

2:35–3:00 Reverse-CSP test + gaps

Explain CSP → host discovery in 3 lines. Triage gaps (email next).

0:00–0:15 SPF/DKIM/DMARC + header-injection points

Write record roles (v=spf1, _dmarc, selector._domainkey) + injection via From/Subject CRLF. Read Google DMARC guidance § policy rows (none/quarantine/reject) ONLY.

0:15–1:05 DNS audit + safe spoof-ability (read-only)

Audit dig TXT + _dmarc + selector on 3 domains (passive DNS). Assess p=none vs reject. No actual spoof sends — read-only + safe reset-mail header test (own accounts). YT: SMTP takeover SPF DKIM DMARC bug bounty.

1:05–2:00 SMTP-takeover chain + DKIM-bypass note

Read 1 SMTP-takeover (unclaimed SendGrid/Mailgun/Zoho MX → inbound control, Smule #2567048 bridge) + 1 DKIM replay/bypass note — claimed service + mail-flow impact ONLY each.

2:00–2:35 Mail-takeover flow review (token delivery path)

Map reset-token email path (sender → MTA → inbox). Note header-injection → token-theft handoff (Week 04 bridge).

2:35–3:00 DMARC-policy test + gaps

Read 3 policies cold (none/quarantine/reject + pct). Triage gaps (live infra next).

0:00–0:15 Sweep order + new-asset rule recall

Order: ASN → takeover → buckets → dorks → pivots → mail. Newest-30-days first. Check HuntBook infra order headings ONLY.

0:15–1:05 Takeover + bucket + exposure sweep (VDP, gentle)

Run subzy --hide_fails --vuln + nuclei -t http/takeovers/ + in-scope cloud_enum + dorks (read-only) on VDP. Benign evidence only, no claiming beyond screenshot proof, no bulk downloads.

1:05–2:00 New-subdomain bug patterns (2)

Read hacktivity subdomain takeover 2 recent (fingerprint + benign PoC) — pattern ONLY. Compare your diff gaps (Week-02 baseline).

2:00–2:35 Infra playbook update + diff workflow (daily)

Update playbook + set daily subfinder + dnsx + nuclei takeovers diff (cron/manual). Add Censys-certs + favicon + mail checks.

2:35–3:00 Infra-triage test + gaps to Week 12

Recite triage (takeover → bucket → secret → pivot → mail). Assign gaps (LLM/mobile/pollution) to Week 12.