got an admin access by doing the flowing
- fuzzing got an endpoint /auth/github
- after login i got nothing
- adding the flowing parma to the auth endpoint ?admin=true&org_admin=true
- logged in as admin :)
#bugbountytips
Just did some serious fuzzing and found a /file/ with a 400 status code. Persistence pays off - I kept at it and eventually uncovered a path traversal vulnerability
#bugbountytips
#BugBounty
i was testing a subdomain didn't find anything , after a while i just changed the "cookie id" which was the value of username to another username and authbypass 🤷♂️
was hacking on a subdomain redirect to SSO login the portal was for admin uploading docs ,start brute force the dir for a week nothing worked,i put the sub name after / and brute forced again ended up accessing the portal and see all docs 🤷♂️
want to share interesting authentication bypass we have found recently
1. the app redirect users to SSO login page
2. read all javascript files we have found endpoint `/SessionStorage.aspx?USER_ID=` add user_id=1
(1)
your target is using jfrog ? you can access it with anonymous login through .io
use dork site: inurl:yourtarget and easy access it :)
#BugBounty
#bugbountytips
This month has been a real challenge with almost no free time.I can confidently say March was one of the most productive periods for me in terms of finding critical vulnerabilities.
#BugBounty
#bugbountytips
I have been awarded the "Hero" recognition by
@SynackRedTeam
this year! This prestigious award is given to SRTs who generate significant value, as determined by overall production and customer impact.