Best Approach to active Directory: 2
https://medium.com/@anekantsinghai/best-approach-to-active-directory-2-b32a8bb2be7e?source=rss------bug_bounty-5

Now in the previous blog we learnt the basics of AD and how to approach a target and what to look for in the first place. In this blog we…Continue reading on Medium » (https://medium.com/@anekantsinghai/best-approach-to-active-directory-2-b32a8bb2be7e?source=rss------bug_bounty-5)

Best Approach to active Directory: 2

Now in the previous blog we learnt the basics of AD and how to approach a target and what to look for in the first place. In this blog we…Continue reading on Medium »
Read more...

QR Code Phishing with EvilGophish
https://www.reddit.com/r/redteamsec/comments/1az850m/qr_code_phishing_with_evilgophish/

submitted by /u/fin3ss3g0d (https://www.reddit.com/user/fin3ss3g0d)
[link] (https://fin3ss3g0d.net/index.php/2024/02/24/qr-code-phishing-with-evilgophish/) [comments] (https://www.reddit.com/r/redteamsec/comments/1az850m/qr_code_phishing_with_evilgophish/)

Business Logic Error in the Comment Section of a Porn site
https://medium.com/@vflexo/business-logic-error-in-the-comment-section-of-a-porn-site-42643f66dfee?source=rss------bug_bounty-5

Hi Guys,Continue reading on Medium » (https://medium.com/@vflexo/business-logic-error-in-the-comment-section-of-a-porn-site-42643f66dfee?source=rss------bug_bounty-5)

Business Logic Error in the Comment Section of a Porn site

Hi Guys,Continue reading on Medium »
Read more...

Create Your Own File Extension

From .txt for text documents to .jpg for images, these extensions provide a shorthand for computers to understand the format and…Continue reading on Medium »
Read more...

Create Your Own File Extension
https://medium.com/@paritoshblogs/create-your-own-file-extension-fa484c677590?source=rss------bug_bounty-5

From .txt for text documents to .jpg for images, these extensions provide a shorthand for computers to understand the format and…Continue reading on Medium » (https://medium.com/@paritoshblogs/create-your-own-file-extension-fa484c677590?source=rss------bug_bounty-5)

Html-Injection [ Bug Bounty ]

# Html-injection-Bug-Bounty- ## Overview This repository is a collection of in-depth articles documenting the bug hunting journey within…Continue reading on Medium »
Read more...

Html-Injection [ Bug Bounty ]
https://medium.com/@rhashibur75/html-injection-bug-bounty-a41f87217118?source=rss------bug_bounty-5

Html-injection-Bug-Bounty-
Overview
This repository is a collection of in-depth articles documenting the bug hunting journey within our…Continue reading on Medium » (https://medium.com/@rhashibur75/html-injection-bug-bounty-a41f87217118?source=rss------bug_bounty-5)

Essential Skills for Successful Bug Bounty Hunting

Bug bounty programs have become a vital component of cybersecurity strategies for organizations worldwide.Continue reading on Medium »
Read more...

500$ Access Control Bug: Performed Restricted Actions in Developer Settings by low level user.

Recently,i found an interesting bug during my testing that enables a supporter to carry out restricted actions within the developer settings, specifically tweaking notifications without proper authorization in an Private Program. This issue sheds light on a loophole where a low-level actor or a restricted supporter can attempt to manipulate the application’s logic.Understanding Target ExamNote(Virtual Name of BBP) is a comprehensive platform designed to prioritize customer needs by offering an all-in-one solution for modern card issuer processing and program management. It empowers businesses to efficiently build and launch new revenue streams, providing a seamless experience for both businesses and their customers.In this context, the identified bug allowing unauthorized actions in the developer settings poses a potential risk.The Bug The bug I discovered in ExamNote a flaw that enables a supporter or low-level actor to perform restricted actions in the developer settings. Specifically, it allows the user to change notifications without the necessary permissions. This issue becomes significant because a user with lower privileges, like a supporter, can attempt to manipulate the application’s logic by creating notifications in the admin developer settings, even though they don’t have the required permissions.Before we move on, if you like my write-ups, please support me by liking, sharing, and clapping up to 50 times here on Medium, it’s free. Thank you.Steps To Reproduce:-Use the admin account to create a notification.Capture the request made during the notification creation process and drop the request.Switch to the supporter or user account and capture any request made.POST /graphql HTTP/2Host: api.us.test.examnote.comAuthorization: Bearer ------------{"query":"mutation AddWebhookNotificationTarget($input: AddWebhookNotificationTargetInput!) {\n addWebhookNotificationTarget(input: $input) {\n _typename\n ... on WebhookNotificationTarget {\n id\n signingKeys {\n createdAt\n id\n secret\n }\n }\n ... on UserError {\n errors {\n path\n code\n description\n }\n }\n }\n}","variables":{"input":{"name":"hello","uri":"https://test.com","subscriptions":"ACH\_EXTERNALLY\_INITIATED\_DEPOSIT\_RECEIVED","ACH\_EXTERNALLY\_INITIATED\_DEPOSIT\_PROCESSED"}}} 4. Change the Authorization: Bearer token of the captured notification setting request to the user/supporter(Attacker account) Authorization: Bearer token. 5. Send the modified request.The Bounty The security vulnerability I identified in ExamNote was deemed significant, and as a recognition of its severity, the company awarded a bounty of $500 for the report. This underlines the importance placed on maintaining the integrity and security of their platform.Takeaway This discovery highlights the critical need for robust security measures in applications like ExamNote. The lesson here is clear: even seemingly minor issues can pose a substantial threat to a platform’s functionality and security. It emphasizes the importance of continuous vigilance from both security researchers and developers to ensure a resilient and secure user experience.Leave some clap if you enjoyed this read, leave your feedback in comment and consider following me for more exciting findings.Find me on Twitter: @a13h1_Thank you everyone Keep Supporting, Keep Clapping, Keep Commenting. 500$ Access Control Bug: Performed Restricted Actions in Developer Settings by low level user. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

Essential Skills for Successful Bug Bounty Hunting
https://medium.com/@Land2Cyber/essential-skills-for-successful-bug-bounty-hunting-fcdca331405e?source=rss------bug_bounty-5