newfolder

Muslim Security Student |
Random Guy who Breaches Networks like a 9mm bullet

[newfolder @newfolderj]

None => Critical (10/10)

Second Order Account Takeover :

(attacker's VERIFIED email attached to attacker's UNVERIFIED email merged can takeover vicitm's VERIFIED account)

H1 : Closing as Self Account Takeover (none).
Me : Should I Takeover your Account?
H1 : Sure!
Me : BOOOM

[newfolder @newfolderj]

@abdilahrf @iustinBB What if the server sends cache:MISS everytime, on existent and non existent path ?
Any way to bypass it ?

[newfolder @newfolderj]

@HusseiN98D Hussein, it took me few days to find out in burp previous saved files but I am unable to send you DM as its blocked and require subscription.

[newfolder @newfolderj]

@iustinBB leet

[newfolder @newfolderj]

@khalidmeister1 @HusseiN98D @samwcyo So whats the point of traversing here or its not vulnerable or should I try something else or maybe you would mind mentioning what you found via the above method as everytime I belive there is nothing when I perform ../ at api endpoints

[newfolder @newfolderj]

@khalidmeister1 @HusseiN98D @samwcyo Irfan I have watched the video several times and read different articles but cant exploit or unable to understand the scenario bcz I get /user/victim = 403 with every traverse e.g /user/me/../victim or /user/me/../../user/victim

[newfolder @newfolderj]

@m4ll0k Paramminer have this functionality, you would need to Tick it when send request to paramminer

[newfolder @newfolderj]

Just submitted my first Smart Contract Bug to the DeFi Protocol, big thanks to Owen, @pashov & @gogotheauditor for their public audits.

[newfolder @newfolderj]

@h4x0r_dz I would suggest to go for web3 ctfs such as etheranut etc

[newfolder @newfolderj]

@AkashHamal0x01 Put and Delete should be same report because of same path.

POST should be in different report.

I would suggest to submit put first , if the program is considering medium then add the delete one to bump the severity .

[newfolder @newfolderj]

@3ncryptSaan @Hacker0x01 Hi ranjan, hackerone told me that we have stopped h1 clear and not accepting any applications. Would you mind telling me when you applied for it and how long did it take ?

[newfolder @newfolderj]

@tosun7331 @osamaavvan Just sent dm

[newfolder @newfolderj]

@osamaavvan Onsite

[newfolder @newfolderj]

@brutexploiter I hope people would get it as it took me and the triager 3 days arguing that what is this and at the end I took his account so marked as critical

[newfolder @newfolderj]

None => Critical (10/10)

Second Order Account Takeover :

(attacker's VERIFIED email attached to attacker's UNVERIFIED email merged can takeover vicitm's VERIFIED account)

H1 : Closing as Self Account Takeover (none).
Me : Should I Takeover your Account?
H1 : Sure!
Me : BOOOM

[newfolder @newfolderj]

@brutexploiter so the victim and the unverified email both got the forget token , attacker change pass and got the victim's account and at the same time his email also get verified and accounts also got merged so at the end victim's account is destroyed and there are now two account of attacker