As you may know, some hackers like using the command line interface and running tools to gather information for later monitoring. I happen…Continue reading on System Weakness » (https://systemweakness.com/go-beyond-with-gretire-313b7fbe3f47?source=rss------bug_bounty-5)
Understanding CVE-2023–46604: A Threat to Apache ActiveMQ
CVE-2023–46604 has emerged as a critical vulnerability in Apache ActiveMQ, an open-source message-oriented middleware (MOM) protocol…Continue reading on InfoSec Write-ups »
Read more...
CVE-2023–46604 has emerged as a critical vulnerability in Apache ActiveMQ, an open-source message-oriented middleware (MOM) protocol…Continue reading on InfoSec Write-ups »
Read more...
Medium
Understanding CVE-2023–46604: A Threat to Apache ActiveMQ
CVE-2023–46604 has emerged as a critical vulnerability in Apache ActiveMQ, an open-source message-oriented middleware (MOM) protocol…
Understanding CVE-2023–46604: A Threat to Apache ActiveMQ
https://infosecwriteups.com/understanding-cve-2023-46604-a-threat-to-apache-activemq-d771eb408eba?source=rss------bug_bounty-5
https://infosecwriteups.com/understanding-cve-2023-46604-a-threat-to-apache-activemq-d771eb408eba?source=rss------bug_bounty-5
CVE-2023–46604 has emerged as a critical vulnerability in Apache ActiveMQ, an open-source message-oriented middleware (MOM) protocol…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/understanding-cve-2023-46604-a-threat-to-apache-activemq-d771eb408eba?source=rss------bug_bounty-5)
Email address: The Online ID
https://medium.com/@duncanochieng682/email-address-the-online-id-dd0061bf7828?source=rss------bug_bounty-5
and the Dangers of it’s exposureContinue reading on Medium » (https://medium.com/@duncanochieng682/email-address-the-online-id-dd0061bf7828?source=rss------bug_bounty-5)
https://medium.com/@duncanochieng682/email-address-the-online-id-dd0061bf7828?source=rss------bug_bounty-5
and the Dangers of it’s exposureContinue reading on Medium » (https://medium.com/@duncanochieng682/email-address-the-online-id-dd0061bf7828?source=rss------bug_bounty-5)
Email address: The Online ID
and the Dangers of it’s exposureContinue reading on Medium »
Read more...
and the Dangers of it’s exposureContinue reading on Medium »
Read more...
Medium
Email address: The Online ID
and the Dangers of it’s exposure
Project 2510: Bug Bounty Challenge — Day 15/25
Welcome to Day 15.Continue reading on Medium »
Read more...
Welcome to Day 15.Continue reading on Medium »
Read more...
Medium
Project 2510: Bug Bounty Challenge — Day 15/25
Welcome to Day 15.
Project 2510: Bug Bounty Challenge — Day 15/25
https://wallotry.medium.com/project-2510-bug-bounty-challenge-day-15-25-27d085f4bf95?source=rss------bug_bounty-5
https://wallotry.medium.com/project-2510-bug-bounty-challenge-day-15-25-27d085f4bf95?source=rss------bug_bounty-5
Welcome to Day 15.Continue reading on Medium » (https://wallotry.medium.com/project-2510-bug-bounty-challenge-day-15-25-27d085f4bf95?source=rss------bug_bounty-5)
My First IDOR - Hiding in the Header Request
In the midst of a busy schedule, the little time I dedicate to bug hunting brings immense joy, especially when I stumble upon something…Continue reading on Medium »
Read more...
In the midst of a busy schedule, the little time I dedicate to bug hunting brings immense joy, especially when I stumble upon something…Continue reading on Medium »
Read more...
Medium
My First IDOR - Hiding in the Header Request
In the midst of a busy schedule, the little time I dedicate to bug hunting brings immense joy, especially when I stumble upon something…
My First IDOR - Hiding in the Header Request
https://medium.com/@hbenja47/my-first-idor-hiding-in-the-header-request-8a03dddc23b5?source=rss------bug_bounty-5
https://medium.com/@hbenja47/my-first-idor-hiding-in-the-header-request-8a03dddc23b5?source=rss------bug_bounty-5
In the midst of a busy schedule, the little time I dedicate to bug hunting brings immense joy, especially when I stumble upon something…Continue reading on Medium » (https://medium.com/@hbenja47/my-first-idor-hiding-in-the-header-request-8a03dddc23b5?source=rss------bug_bounty-5)
Crafting XSS (Cross-Site Scripting) payloads
Crafting XSS (Cross-Site Scripting) payloads is a significant aspect of learning about web application security, particularly for…Continue reading on InfoSec Write-ups »
Read more...
Crafting XSS (Cross-Site Scripting) payloads is a significant aspect of learning about web application security, particularly for…Continue reading on InfoSec Write-ups »
Read more...
Medium
Crafting XSS (Cross-Site Scripting) payloads
Crafting XSS (Cross-Site Scripting) payloads is a significant aspect of learning about web application security, particularly for…
CVE-2023–36025: An In-Depth Analysis of Circumventing Windows SmartScreen Security
In the world of cybersecurity, the discovery of a vulnerability like CVE-2023-36025 in Windows SmartScreen is a significant event. This…Continue reading on InfoSec Write-ups »
Read more...
In the world of cybersecurity, the discovery of a vulnerability like CVE-2023-36025 in Windows SmartScreen is a significant event. This…Continue reading on InfoSec Write-ups »
Read more...
Medium
CVE-2023–36025: An In-Depth Analysis of Circumventing Windows SmartScreen Security
In the world of cybersecurity, the discovery of a vulnerability like CVE-2023-36025 in Windows SmartScreen is a significant event. This…
Budget Change: IDOR 1000$ Bug
Discover how an IDOR vulnerability allowed unauthorized budget changes in Private Program. Learn the steps to reproduce this security flaw and its potential impact on user privacy. IDOR vulnerabilities can potentially expose user data or allow unauthorized access to sensitive features. In this blog post, I’ll walk you through a recent discovery I made while testing Examlent.com(virtual name of privat program domain), a platform where individuals seek job opportunities and employers find potential candidates. This IDOR flaw had the potential to compromise user privacy by letting an attacker manipulate a user’s budget without their consent.The IDOR Bug As a bug bounty hunter, my mission was to explore Examlent.com for any potential security vulnerabilities. During my testing, I discover an intriguing IDOR (Insecure Direct Object Reference) bug that allowed any user to change another user’s budget without taking over their account. The endpoint responsible for this flaw was /employers/posts/ajax/action-crud-job.php?country=us&language=en&hid=------.Steps to ReproducePrepare Two Accounts: You’ll need two different accounts for this test — one as the attacker and the other as the victim.Capture the Edit Budget Request: Use your attacker account to capture the “Edit Budget” request made by the victim.Identify the hid= Value: Now, you may be wondering how the attacker can obtain the `hid=` value. Well, in this scenario, the attacker is conducting a random attack because here the hid has only 8 char long. They can attempt to brute force random id values.Send the Request: With the “Edit Budget” request and the hid= value in hand, the attacker can now send the request.Observe the Change: As a result, you’ll notice that the budget of the victim’s account has been altered without their consent.The Impact The unauthorized budget change not only compromises user privacy but also potentially results in financial losses, creating significant repercussions for both the victims and the platform’s integrity.The Bounty This critical IDOR vulnerability raised awareness about the need for enhanced security measures. Recognizing the significance of this discovery, Examlet.com promptly awarded a bounty of $1000 to me.Takeaway This IDOR bug underscores the importance of continuously examining web applications for potential vulnerabilities. Security researchers should consider testing the boundaries of permissions within applications to see if they can make changes without gaining full access to another user’s account.Leave some clap if you enjoyed this read, leave your feedback in comment and consider following me for more exciting findings.Find me on Twitter: @a13h1_Thank you everyone Keep Supporting, Keep Clapping, Keep Commenting. Budget Change: IDOR 1000$ Bug was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Discover how an IDOR vulnerability allowed unauthorized budget changes in Private Program. Learn the steps to reproduce this security flaw and its potential impact on user privacy. IDOR vulnerabilities can potentially expose user data or allow unauthorized access to sensitive features. In this blog post, I’ll walk you through a recent discovery I made while testing Examlent.com(virtual name of privat program domain), a platform where individuals seek job opportunities and employers find potential candidates. This IDOR flaw had the potential to compromise user privacy by letting an attacker manipulate a user’s budget without their consent.The IDOR Bug As a bug bounty hunter, my mission was to explore Examlent.com for any potential security vulnerabilities. During my testing, I discover an intriguing IDOR (Insecure Direct Object Reference) bug that allowed any user to change another user’s budget without taking over their account. The endpoint responsible for this flaw was /employers/posts/ajax/action-crud-job.php?country=us&language=en&hid=------.Steps to ReproducePrepare Two Accounts: You’ll need two different accounts for this test — one as the attacker and the other as the victim.Capture the Edit Budget Request: Use your attacker account to capture the “Edit Budget” request made by the victim.Identify the hid= Value: Now, you may be wondering how the attacker can obtain the `hid=` value. Well, in this scenario, the attacker is conducting a random attack because here the hid has only 8 char long. They can attempt to brute force random id values.Send the Request: With the “Edit Budget” request and the hid= value in hand, the attacker can now send the request.Observe the Change: As a result, you’ll notice that the budget of the victim’s account has been altered without their consent.The Impact The unauthorized budget change not only compromises user privacy but also potentially results in financial losses, creating significant repercussions for both the victims and the platform’s integrity.The Bounty This critical IDOR vulnerability raised awareness about the need for enhanced security measures. Recognizing the significance of this discovery, Examlet.com promptly awarded a bounty of $1000 to me.Takeaway This IDOR bug underscores the importance of continuously examining web applications for potential vulnerabilities. Security researchers should consider testing the boundaries of permissions within applications to see if they can make changes without gaining full access to another user’s account.Leave some clap if you enjoyed this read, leave your feedback in comment and consider following me for more exciting findings.Find me on Twitter: @a13h1_Thank you everyone Keep Supporting, Keep Clapping, Keep Commenting. Budget Change: IDOR 1000$ Bug was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
Budget Change: IDOR 1000$ Bug
Discover how an IDOR vulnerability allowed unauthorized budget changes in Private Program. Learn the steps to reproduce this security flaw…
Chaining CORS by Reflected XSS to Steal Sensitive Data
https://infosecwriteups.com/chaining-cors-by-reflected-xss-to-steal-sensitive-data-c456e133c10d?source=rss------bug_bounty-5
https://infosecwriteups.com/chaining-cors-by-reflected-xss-to-steal-sensitive-data-c456e133c10d?source=rss------bug_bounty-5