Aditya

[Aditya @Aditya_sec_info]

I observed that the avatar field in this request accepts any arbitrary URL without validation. The response was bucket link which was accessible with simple curl req and i could see it is storing files from the server.
https://t.co/aFji0dcfW6

[Aditya @Aditya_sec_info]

I was hunting on a BBP and reported ssrf to them but they said this is third party issue so i ended up reporting to VDP. avatar_url param was not validated and putting compress.zlib:///etc/passwd allows reading arbitrary files from the server's filesystem.

[Aditya @Aditya_sec_info]

@foilmanhacks Send this to my Intruder. I will guess it right.

[Aditya @Aditya_sec_info]

@rushikasec @GodfatherOrwa @lostsec_ @tabaahi_ If there is some endpoints like /api-docs
Try /Api-Docs
it might leak full swagger api.

[Aditya @Aditya_sec_info]

@security_index @GoogleVRP This was found on their own product or third party component?

[Aditya @Aditya_sec_info]

@lostsec_ @lostsec_ After finding api endpoints the response is 401 mostly so how to bypass those authorization if the app is properly configured. which header or data to manipulate and how to do so? would really appreciate if u can reply.

[Aditya @Aditya_sec_info]

A private S3 bucket (403 on direct access) meant nothing because a separate unauthenticated endpoint would sign any path you handed it. /common/get-signed-url?url=<an S3 file path> It bypassed the private s3 bucket.
#BugBounty

[Aditya @Aditya_sec_info]

@InsiderPhD The worst part is I have to do calling and take follow up with HR's and i'm doing it because it pays my bill, but I'm interested in web app security. One good part is it is fully remote so i have another screen open related to learning security stuff. I Need guidance to switch?

[Aditya @Aditya_sec_info]

I just completed AWS Security - S3cret Santa room on TryHackMe. Learn the basics of AWS enumeration. https://t.co/Ixb3hhPEHo #tryhackme via @tryhackme