puimpsyc🇦🇷

Security Researcher - Bug Bounty Hunter

[the_IDORminator @the_IDORminator]

I spent ~6 hours yesterday working on a target. If you check my recent post about "Step 1", I was on part "D". I found 3 distinct P1s, one of which probably could have been broken down into 8 specific BAC issues but that sounded like too much work.

Issue 1: LFI/traversal
As I mentioned, this was found by searching all of my recon files (batch GAU outputs) for "filename=", then tinkering with any of them that looked susceptible. This was literally a one-liner in a GAU file, that could have been easily overlooked because the stem of the URI path actually ended in .PDF, which turned out to have no impact on the URI param itself. Probably why it was missed in the past. So it looked like /app/filename.pdf?filename=test.pdf; but /app?filename=test.pdf still brought the file back, and the LFI was in the filename param.

Issue 2: Account Takeover
After self registering on a site, I was able to find a section that lets you "invite a user" to your team, and assign a role like admin. However, the payload didn't check the team integer belonged to me, so I could invite myself via email as an administrator to any team in the system, granting full access. Oops. This was an IDOR in a POST JSON body. You find this stuff by using the software and interacting with it.

Issue 3: Privilege Escalation BAC
After self registering for a site, I dumped all of the API paths from any JS I could find. I made sure to remove any that said logout or logoff. I do this so my session isn't logged off while testing. I then hit them all in intruder with my authenticated session, and noted those which did not 403 or 302 redirect to the logoff or logon page (indicating no access). I then assessed each request that had a 200, and noted ~8 administrative pages that had read/write access to important functions and PII.

In summary, no I do not think bounty has gotten any harder, looks like the same game. That was about a $2500/HR hunting spree assuming no duplicates and what not. AI is a capable tool now for hunting, but it will be a long time if ever before it effects the bug count on the internet at large. That said, I hear actually getting triaged and paid may be a different matter these days 🤣

How did AI help?
AI was able to very quickly help me find LFI paths given the architecture/stack to dump important files AFTER discovering the bug. This would have been more difficult in the past. I use it for very specific tasks to speed things along, help with payloads, parse JS, and things of that nature... when needed. Its not the first thing I turn to.

[obscaries ❘ AppSec @obscaries]

AWS Penetration Testing Guide: Techniques & Methodology

https://t.co/gnseG9stgb

[obscaries ❘ AppSec @obscaries]

Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108)

💀 https://t.co/7n7dxUy811

[sin99xx @sin99xx]

I always say don't learn payloads, learn protocols

https://t.co/hVvx028Fn2

[puimpsyc🇦🇷 @puimpsyc2]

@akita_zen @the_IDORminator Me too!

[Coffin @lostsec_]

Hi everyone! I just built a WaybackURLs extension that saves you a ton of time when gathering archive URLs. it supports main domains, wildcards, specific paths and sensitive file extensions.
Give it a try and let me know your feedback!
https://t.co/vezBMPFpgp

[Rodolfo Assis @RodoAssis]

Talking about #SSRF, I just got an idea to add SSRF-based #XSS to @KN0X55 !

It's coming in the update next week most probably.

#WebAppSec #BugBounty #PenTesting

[puimpsyc🇦🇷 @puimpsyc2]

@CaidoIO Argentina

[puimpsyc🇦🇷 @puimpsyc2]

@TheMsterDoctor1 send 😎

[Joseph Thacker @rez0__]

I'm a hacker and AI researcher who has reported vulnerabilities to OpenAI, Google, and others. I wrote this guide as a reference of all of the ways that you can hack AI.

It has saved me hours. Bookmark this if you need a reference for what all to try (AND includes mitigations).

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Finally my video about / new GitHub droning / bing dorking and more amazing content on @Bugcrowd

https://t.co/MyVQC1Ayi6

Hope you like it and found this one useful ❤️❤️

#bugbountytip #bugbountytips #bugbounty

[Het Mehta @hetmehtaa]

DEFCON Recordings for Cyber Security Learners

🔗 https://t.co/39SVveZP28

#CybersecurityNews #cybersecuritytips #infosec #HackTheBox

[/ XNL -н4cĸ3r (and @xnl-h4ck3r in the new Sky) @xnl_h4ck3r]

Thanks to @DanaEpp newsletter for this tip...
When configuring a Burp Intruder attack, loading a huge wordlist or payload database directly in the UI using "simple list" can consume a lot of memory.
But you can use "Runtime file" instead, bypassing preload & memory constraints!

[Cybernetic Research @cybernetic_res]

SSTI (Server Side Template Injection) Payload List
Credit:@Botami143
#bugbountytips #bugbounty

[Hussein Daher @HusseiN98D]

⚠️"Attacking Organizations with Big Scope - from 0 to Hero" was my talk at #HitBxPhdays in Bangkok 🇹🇭. Happy to share the slides and recording with the community.
🔴 Slides: https://t.co/03GfeE5KCR
🔴 Recording:
https://t.co/KpBNtQm6tm

Enjoy!
#bugbounty #infosec #bugbountytips

[shubs @infosec_au]

My colleague @hash_kitten and I discovered a full-read SSRF vulnerability in Next.js (CVE-2024-34351). We published our research today on @assetnote's blog: https://t.co/pUXGG64B0O. Thank you to the Vercel team for a smooth disclosure process.

[zseano @zseano]

something interesting i noticed that happens to most new public programs: big surge of reports for a period of time, they eventually "top out", and then a downwards curve (1/n)

(data from https://t.co/q4jrzi9jWw)

[puimpsyc🇦🇷 @puimpsyc2]

My first P1 in bug bounty, @bugcrowd https://t.co/nCVbneDqwr #ItTakesACrowd

[zseano @zseano]

New hackerone platform standards coming 2nd april:

1. IDORs with unpredicable IDs
2. Systemic Issues
3. Leaked credentials
4. Bypassing resolved reports

Full info: https://t.co/6kG7pJUDfk

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

soon enough there will be a video for BugCrwod Level Up
explaining how I found 90% from P1s for the last 12 months with a lot of BB Tips