Its my birthday 🎉! So Imma post a quick little
#bugbountytip
1) Recruitment site, had option to upload pdfs (CV, Resume, certs and other docs)
2) Saw the upload functionality, files uploaded to s3 bucket i.e.
(1/n)
I earned $2,300 for my submission on
@bugcrowd
#ItTakesACrowd
#bugbounty
Small PoC:
1) Used dork: inurl:
2) Searched through first 10 pages manually.
3) Came across a site having some example code snippets
(1/2)
Hey all! A quick AEM
#bugbountytip
for you guys!
Appending the query "?tidy=true" to the JSON output of any endpoint prettifies it for you.
(Check pics 1&2)
Also, certain times it might help you to break the caching behaviour of AEMs too! Have fun with this.
(Pic 1/2)
I earned $2,700 for my submissions on
@bugcrowd
#ItTakesACrowd
1) Access to spring boot endpoints leading to multiple vulns(2100$)
2) Ability to send email from anybody
@company
.com by abusing their fax functionality (600$)
Using Firefox? Small tip:
Hit about:config and type general.useragent.override
Now, select the String option and hit + and then, paste in your Blind XSS Payload.
Useful, in case you're too lazy to open burp, just right in your browser itself.
(1/3)
#cybersec
#hacking
#bugbounty
Let's make this a thread:
List atleast one technique you learned from CTFs that you used/can be used IRL
Mine: Prepending GIF magic bytes to a malicious php shell led to File-Upload Bypass and command execution.
Comment!
#bugbountytips
#bugbountytip
#cybersecurity
3) simple google dork:
site: ext:pdf
4) Guess what! Tonnes of PII🙈
5) Stepping it up, I noticed the docs being saved as
6) Brute force away! Even more PII!
P1 -> $$$$
S3 access control issue -> IDOR -> PII
(n/n) Enjoy Guys! 🎉❤️
Small dork to pull up list of Openfire Admin Console for CVE-2019-18394
Google
intitle:"Openfire Admin Console"
Shodan
http.title:"Openfire Admin Console"
#bugbountytip
#bugbountytips
#bugbountytips
For beginners getting started, stay away from accounts that only post about random tools and 'how to get started' tweets for engagement farming. They probably are not a subject matter expert and you either won't gain much from them :)
While pentesting JIRA/Confluence webapps, if you ever come across this warning, simply add:
X-Atlassian-Token: no-check in the request body and that would probably bypass this warning.
#bugbountytip
#bugbountytips
I earned $1400 for my submissions on
@bugcrowd
Bug 1:
Unauthenticated Access to Apache Example Servlet leading to multiple vulnerabilities (1200$)
Bug 2:
Access to client's test account via pastebin(200$)
#ItTakesACrowd
#bugbountytip
#bugbountytips
Have a possible XSS on AEM target, but application renders it in JSON?
Simply append the query to the url -> "?mimeType=text/html" to get it to render in HTML format.
Note: Might not work for all instances.
.
@RockWithboAt
should invest in a Bug Bounty Program with actual rewards. This attracts top-tier talent, who don't work for free
While due attention to overall security posture is crucial atm, this would certainly, plug a lot of holes.
It's high time now!
@amangupta0303
#boat
Inviting all the security researchers to register on India's First Crowdsourced Penetration Testing Platform...
Visit:
Go ahead & register yourself.
Helping a friend out!
SSRF on GCP? Can't extract metadata? Can't set headers? No internal subdomains? Tried every SSRF resource on the internet?
Still no success?
Me and
@RathiArpeet
managed to find one such SSRF that led to a sweet bounty.
Stay tuned, dropping it soon!
#infosec
#BugBounty
Using FireFox? But tired of that annoying request to detectportal(.) on startup?
Go to about:config
Search "captive"
Switch network.captive-portal-service.enabled" to false
#mozilla
#web
A very sad truth of BB :
People are happy with a med when you can possibly turn it into a crit with a little bit of digging, but they're just too naive or rather too lazy to make an effort. Ruins his/her and other's chances of getting a crit too!
#infosec
#BugBounty
org: http.title:rocketmq-console
A small shodan dork to pull up RocketMQ console which often has quite confidential production information disclosed.
#bugbountytips
#bugbountytip
The results are in!🥇
Congratulations to these 32 teams who will move on to the Group Round of the 2024
#AmbassadorWorldCup
! 🙌
The next round kicks off at the end of August! Stay tuned for the latest info, and read more about the AWC here.
My drafted talk deals with a similar situation i.e.: how to SSRF when AWS/GCP metadata access fails.
(I wish some conferences accept it, instead of the regular jargon you see in infosec everyday)
Severity is totally unjustified
4) Came across a PHP code snippet originally hosted on github but referenced there.
5) grepped for username and password in the code snippet.
6) Found Username, password and admin endpoint
7) Logged in and had access to full PII
(2/2)
Feel free to DM me if you require escalating any
#AEM
security issues. I’ll try my best.
However, please note :-
a) I don’t encourage VDPs
b) Not at all times its possible to bypass dispatcher filters/ find critical issues. Please bear with that.
#BugBounty
#infosec
#hacking
Dear all SSRF Lords,
On a Backend running Ruby 5.0.2 & Squid Proxy and a Full Response SSRF. What all can we try?
(Basic stuff already tried)
#bugbounty
#infosec
[+]
#BugbountyTip
:
When testing for anonymous write access on Adobe AEM in "/content/usergenerated/*" If you get HTTP 404, try bypassing the dispatcher filter rules like this:
"/ANYEXISTINGFOLDER/..../content/usergenerated/test"
#Bugbounty
#TogetherWeHitHarder
#AdobeAEM