@hackerspider1@KiaInd@Apple@Tesla Totally agree. ๐ฏ
For me, @KiaInd stands out as the best option in this price segment in India. Premium features, strong quality, and real value for money.
My 2022 Kia Carens has already done 42,000 km and I still donโt regret choosing it for a second.
๐RCE in mailโ ๏ธ
In Login/register page:
1. Insert a normal mail and intercept on burp
2. Replace the mail to OS command payload
3. Don't use space in the payload
4. Replace space to ${IFS}
5. Try blind OS injection using burp collab URL
Join my telegram https://t.co/J6uPf8H57o
DAY 1:
Found R XSS via iconURL parameter ๐ต๏ธ๐ฐ
https://Redacted/o/marketplace-app-manager-web/icon.jsp?iconURL=https:///%22%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E
Portal: Marketplace manager
Bug: Reflected XSS
#XSS#BugBounty#WebSecurity#Hacking#InfoSec
x 1/6
Back with 5 hard-earned #bugbounty lessons after vanishing for a while:
Pivot, donโt quit.
Bored of the main web app? Switch to API โ Docs โ Mobile app of the same target. Depth beats breadth.
#infosec#bugbountyhunting#cybersecurity
x 6/6
Summary:
Recon is multi-layered (JS โ JSON โ API โ Roles).
Stay in one program longer.
Test every path, every role.
Forgotten dev files & legacy endpoints still pay big.
Consistency beats talent. Day 1 is today.
#bugbounty#infosec#cybersecurity#bugbountytips#hackers
After vanishing from the scene, I'm officially back on the bug bounty grind. ๐
Day 1 starts NOW.
โ 10 AM - 7 PM:
10-2 PM: Deep Learning
2-3 PM: Break
3-7 PM: Active Hunting
Consistency is the key. The journey begins again.
#BugBounty#CyberSecurity#HackTheBox#infosec#Day1
Lets learn Auth Bypass via Session Stuffing! Easy P1s to find if the target is susceptible.
Ok, so what's "Session Stuffing"?
In the wonderful land of server-side code, developers can use session variables to store information. These variables can be things like your username, your user id, your preferred pickup location for groceries, really anything. These variables are stored server side only, so in general, some action triggers creating or changing them.
Imagine we have a variable scope called "session" (that stores the session variables). So we may have a "session.userId" and "session.userName" and "session.idLoggedIn".
Login Dialogue
When you enter the correct username and password on a login screen, the server could decide it wants to store your user name, and the fact that you are logged in. So server code may say "if session.isLoggedIn = true, do some lookup using session.userName". You with me?
Forgot Password
Nobody that is already logged in would need to hit a forgot password screen right? So devs don't necessarily think of this use case. But imagine you open the forgot password screen intended for unauthenticated visitors, after already having logged in.
Lets say the forgot password box asks for your username, so it can send you a password reset link or ask you a password reset question. It needs to know if you have an account first. It temporarily sets session.userName to whatever you type in.
Lets stuff this puppy
So what happens if we login to bobs account?
Server sets:
session.isLoggedIn = true
session.userName = bob
Now while still logged in, we pivot to the 'forgot password' tab. We key in username "tina".
Server temporarily sets session.userName = "tina" to pull back password reset questions.
Back on bobs account page, I now hit refresh, and I'm now logged in and see all of Tinas information, and actually have become Tina.
What happened here?
The doofus devs used the same session variable for forgot password and login dialogues and did not force logout when utilizing password reset. So one page stuffs/replaces a variable in an already authenticated session, resulting in a total auth bypass for anyone else's account via username only.
Result?
I've done this on some Fortune 10 websites, some banking software used by 1000s of banks, and on some electric utilities (all with permission). In the case of the online banking software, it was absolutely terrifying that something this dumb could have led to many, many millions in theft.
Make sure to test for dumb stuff like this! And people say hacking is hard... ๐
#CyberSecurity #infosec #bugbounty #Hacking