Ran dig axfr against a handful of domains today. Still wild how many just hand over the whole zone file, no auth needed.
Open redirect filters often just check the URL starts with your domain. Add an @ before it and the browser reads everything after as the real host.
333 of 543 S&P 500 companies (61.3%) serve live HTTPS with zero HSTS header — 10,314 host findings.
323 of those 333 (97.0%) have no HackerOne bounty coverage.
Palo Alto Networks (a security vendor) has 118 such hosts, unreported to anyone.
nullblocks.com/blog/missing-…
Pull a target's ASN, then reverse-search every IP block registered under it. Half their real shadow IT never shows up under the main domain.
Ever check /swagger.json or /openapi.yaml on a target before poking endpoints by hand? Half the API surface is often just sitting there, documented.
Open Firebase realtime DBs still let you read the whole JSON tree with default rules -- no auth, just the URL.
Wild how many domains skip CAA records. Without one, literally any public CA can issue a cert for your domain and you'd never know.
Half the CORS configs I check just reflect whatever Origin you send back, credentials allowed. That's not access control, it's an open door.
Reverse WHOIS turned up 840 real sister domains across 25 S&P 500 companies. 19 of those 25 have zero HackerOne bounty coverage anywhere.
Workday's myworkday.com alone carries 3 CRITICAL/CVSS-10.0 CVEs with no bounty coverage on file.
nullblocks.com/blog
Still finding .DS_Store files in web roots in 2026. macOS quietly writes one to every folder, and it leaks a full directory listing if the server serves it.
Ever notice password reset forms respond differently for real accounts vs fake ones? That gap alone is free account enumeration.
NetScaler auth bypass, CVSS 9.3, no exploits seen yet. With Citrix bugs that gap never lasts long. Patch before the PoC drops.
Found an exposed Kubernetes dashboard with zero auth once. Full cluster control, no login screen in sight.
Startling how many Elasticsearch clusters still ship with zero auth. Curl _search and the whole dataset comes back.
4 exposure classes scanned across the S&P 500. Same pattern every time:
Takeover: 23/24 no bounty coverage
GraphQL: 22/24 no coverage
Wayback legacy: 95/103 no coverage
Critical CVEs: 330/341 no coverage
Not a one-off stat. Structural.
nullblocks.com/blog
JARM fingerprints cluster servers by TLS handshake behavior, not certs or IPs. Two totally unrelated domains sharing a JARM hash usually means same infra.
157 of 543 S&P 500 companies (28.9%) serve live traffic on a host with an expired TLS cert. Dell's b2bsas2.dell.com cert expired 2015-01-27, 4,225 days ago, still answering. 6th independent exposure class, same gap. nullblocks.com/blog/expired-…
Ever grep a site's JS bundle for a Sentry DSN? Half the time it's just sitting there, public and writable.
Half the leaked AWS keys I see start with someone committing a .env file "just this once." git log -p is forever.