Lavesh Verma

Lazy

[Lavesh Verma @_4ft3rd4rk]

Check out my first bounty writeup on how I bypassed a CSRF check to disable withdrawals in one click :))

https://t.co/346cweVoNy

#bugbountytips #BugBounty #hackerone

[Lavesh Verma @_4ft3rd4rk]

@ba1xia0ta0 if you notice angular brackets or double quotes being injected without any encoding, try basic payloads, if blocked by waf, identify the cdn (wappalyzer) and search for known bypass techniques

[Lavesh Verma @_4ft3rd4rk]

Check out my first bounty writeup on how I bypassed a CSRF check to disable withdrawals in one click :))

https://t.co/346cweVoNy

#bugbountytips #BugBounty #hackerone

[Lavesh Verma @_4ft3rd4rk]

@ba1xia0ta0 I won't recommend automating xss though, just check if angular brackets and double quotes are escaped, this is enough to prevent xss (not talking abt dom xss here)

[Lavesh Verma @_4ft3rd4rk]

https://t.co/Mvv8Uz270y

[Lavesh Verma @_4ft3rd4rk]

Pretty nice experience organizing a ctf :)) everything is going so well!

Thanks to @whizhack @offsectraining @hof_iiitl and @equinoxiiitl for sponsoring this event!

#ctf #incognitoctf

[Lavesh Verma @_4ft3rd4rk]

@nayeems3c That was out of scope, my point was that if the victim forgets to log out their account on a public computer, an attacker can alter victim's email and misuse the forgot password option to takeover the entire account

[Lavesh Verma @_4ft3rd4rk]

Rewarded 300$ for Email change authentication bypass :)

Changing email required password, There was a form to change our personal details -> intercept -> found business email parameter -> change to attacker's email -> request password reset and got reset link on attackers email

[Lavesh Verma @_4ft3rd4rk]

It happens when I use those common SSRF one-liners, I don't see any referer header, so now I don't know from which url I got that hit. Here I am just passing a base64 value of that url to my interactsh.

If you got a pingback from your own IP, you have an open redirect.

[Lavesh Verma @_4ft3rd4rk]

While improving my automation script, I wrote this one liner bash for SSRF

Gather all the output from paramspider and run -

[Lavesh Verma @_4ft3rd4rk]

@tsarprince Lol maybe its iiitl[.]ac[.]in

[Lavesh Verma @_4ft3rd4rk]

Just reported a mass PII Leak. 50 Thousands of emails, name, phone numbers, and addresses!

Decoded a parameter value -> It was Base64 encoding of IDs -> Base64encoded SQLi

Besides, Cracked admin hash -> Admin uploading functionality -> Web shell

Felt like solving an HTB Box😪

[Lavesh Verma @_4ft3rd4rk]

@jamaledim Create an html page and use https://t.co/wR9483R9lT() to open that webpage

[Lavesh Verma @_4ft3rd4rk]

@Prathameshwarak Thanks.
Iska writeup abhi ni likha, medium ka link profile pe pinned h

[Lavesh Verma @_4ft3rd4rk]

@eagle_0408 Will share it on medium soon

[Lavesh Verma @_4ft3rd4rk]

@mahfujwhh I saw a post where an attacker was able to takeover the website through this. If the wordpress is not already set up, we will be able to install the wordpress and configure it to get admin access.

[Lavesh Verma @_4ft3rd4rk]

Whenever I see a wordpress site -

1. Run wpscan
2. /wp-json/wp/v2/users /wp-json/?rest_route=/wp/v2/users[/n] /?author=n and try common passwords.
3. /wp-admin/install.php
4. /wp-config.php.zip /wp-config.php.bak
5. /wp-content/debug.log
6. SSRF /wp-json/oembed/1.0/proxy?url=

[Lavesh Verma @_4ft3rd4rk]

@hhacksio Well I've never found this one on any real world website yet, took reference from here https://t.co/hnQ1fluVdq
oembed proxy endpoint is just to fetch and return the oembed data for the given url, so it should not be blind if you are fetching json or xml from the local

[Lavesh Verma @_4ft3rd4rk]

@0xtheM7 And api key

[Lavesh Verma @_4ft3rd4rk]

@Animesh225 Good for us😂