Bug: Broken access control
1. Admin add User-A
2. User-A capture request on adding files
3. Admin remove User-A
4. User-A can edit the file details from captured request & add new files forever😀
#bugbounty#bugbountytips#hackerone
#bugbountytips#bugbounty Facebook Account takeover Trick to #Bypass#Facebook email disclosure
1.Interesting endpoint
2.Bruteforces the cli
3.OTP verification endpoint and sets a new password for victim’s account.
More..https://t.co/gkxlfDP64X
#bugbountytips#bugbounty IDOR + DOS Trick to #Bypass Application’s Logic to #DOS Attack
1. What do you understand by DOS attack
2. #IDOR
3. IDOR -> DOS
4. What does this script do
5. Impact
More..https://t.co/Qbrbpasbrg
If the WAF Blocks your every xss payload, Then use
document.location++
to show the impact.
Upon JS execution, you/victim will be redirected to http(s)://<domain>.com/NaN
This trick will save lot of time, after reporting take your time to escalate the impact.
Good Luck 👍
Intresting 2fa bypass
Here I was able to bypass the 2fa by changing the request method
After Loging in, It asked me to enter the 2fa , I took the resend request on burp and changed the request method to DELETE from POST and 2fa setup was deleted
#bugbountytips#bugbounty
2FA Bypass Techniques
1.)Response Manipulation:-In response if "success": false, change it to "success": true
2.)Status Code Manipulation:-If status code is 4xx. try to change it to 200 OK and see if it bypass restrictions.
3.)2FA Code Reusability:-Same code can be reused.
If you've found an OS command Injection with WAF enabled, special characters like (/"'&|()-;:.,`) and whitespaces blocked. Try this method to bypass.
-
E.g.: reading /etc/passwd file:
cat$IFS$9${PWD%%[a-z]*}e*c${PWD%%[a-z]*}p?ss??
-
Credit: Aysar Harb
-
#cybersecurity#pentesting