New bug bounty(vulnerabilities) collector
Requirements
Chrome with GUI (If you encounter trouble with script execution, check the status of VMs GPU features, if available.) Chrome WebDriver
Preview
# python3 main.py

*2024-02-20 16:14:47.836189*

1. Arbitrary File Reading due to Lack of Input Filepath Validation
- Feb 6th 2024 / High (CVE-2024-0964)
- gradio-app/gradio
- https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741/

2. View Barcode Image leads to Remote (https://www.kitploit.com/search/label/Remote) Code Execution
- Jan 31st 2024 / Critical (CVE: Not yet)
- dolibarr/dolibarr
- https://huntr.com/bounties/f0ffd01e-8054-4e43-96f7-a0d2e652ac7e/

(delimiter-based file database) # vim (https://www.kitploit.com/search/label/Vim) feeds.db

1|2024-02-20 16:17:40.393240|7fe14fd58ca2582d66539b2fe178eeaed3524342|CVE-2024-0964|https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741/
2|2024-02-20 16:17:40.393987|c6b84ac808e7f229a4c8f9fbd073b4c0727e07e1|CVE: Not yet|https://huntr.com/bounties/f0ffd01e-8054-4e43-96f7-a0d2e652ac7e/
3|2024-02-20 16:17:40.394582|7fead9658843919219a3b30b8249700d968d0cc9|CVE: Not yet|https://huntr.com/bounties/d6cb06dc-5d10-4197-8f89-847c3203d953/
4|2024-02-20 16:17:40.395094|81fecdd74318ce7da9bc29e81198e62f3225bd44|CVE: Not yet|https://huntr.com/bounties/d875d1a2-7205-4b2b-93cf-439fa4c4f961/
5|2024-02-20 16:17:40.395613|111045c8f1a7926174243db403614d4a58dc72ed|CVE: Not yet|https://huntr.com/bounties/10e423cd-7051-43fd-b736-4e18650d0172/

Notes
This code is designed to parse HTML elements from huntr.com, so it may not function correctly if the HTML page structure changes. In case of errors during parsing, exception handling has been included, so if it doesn't work as expected, please inspect the HTML source for any changes. If get in trouble In a typical cloud (https://www.kitploit.com/search/label/Cloud) environment, scripts (https://www.kitploit.com/search/label/Scripts) may not function properly within virtual machines (VMs).

Download Huntr-Com-Bug-Bounties-Collector (https://github.com/password123456/huntr-com-bug-bounties-collector)

Jenkins Arbitrary File Reading Vulnerability (CVE-2024–23897) — Bug Bounty Tuesday
https://medium.com/@kerstan/jenkins-arbitrary-file-reading-vulnerability-cve-2024-23897-bug-bounty-tuesday-8e3a69443d9b?source=rss------bug_bounty-5

Today is Bug bounty Tuesday, I will share with you about Jenkins Arbitrary File…Continue reading on Medium » (https://medium.com/@kerstan/jenkins-arbitrary-file-reading-vulnerability-cve-2024-23897-bug-bounty-tuesday-8e3a69443d9b?source=rss------bug_bounty-5)

Reconnaissance: A Google-Dorking Affair

High quality reconnaissance is a key skill in many areas of information security…Continue reading on Medium »
Read more...

Reconnaissance: A Google-Dorking Affair
https://medium.com/@kieran.x.willey/reconnaissance-a-google-dorking-affair-21edfb4e3b0f?source=rss------bug_bounty-5

High quality reconnaissance is a key skill in many areas of information security…Continue reading on Medium » (https://medium.com/@kieran.x.willey/reconnaissance-a-google-dorking-affair-21edfb4e3b0f?source=rss------bug_bounty-5)

The Exploitation of Massive Slack Workspaces Registration Vulnerability

Greetings, fellow cyber voyagers!Continue reading on Medium »
Read more...

The Exploitation of Massive Slack Workspaces Registration Vulnerability
https://medium.com/@siratsami71/the-exploitation-of-massive-slack-workspaces-registration-vulnerability-0c0e76e5cd3e?source=rss------bug_bounty-5

Greetings, fellow cyber voyagers!Continue reading on Medium » (https://medium.com/@siratsami71/the-exploitation-of-massive-slack-workspaces-registration-vulnerability-0c0e76e5cd3e?source=rss------bug_bounty-5)

CVE-2023–40000: How Safe Is Your Internet Box? ️

Cisco Device Hack Alarms Web WorldContinue reading on Coded Tech Talk »
Read more...

CVE-2023–40000: How Safe Is Your Internet Box? ️
https://medium.com/coded-tech-talk/cve-2023-40000-how-safe-is-your-internet-box-%EF%B8%8F-06ff1f872f7b?source=rss------bug_bounty-5

Cisco Device Hack Alarms Web WorldContinue reading on Coded Tech Talk » (https://medium.com/coded-tech-talk/cve-2023-40000-how-safe-is-your-internet-box-%EF%B8%8F-06ff1f872f7b?source=rss------bug_bounty-5)

9.5 Lab: Exploiting time-sensitive vulnerabilities | 2024

This lab contains a password reset mechanism. Although it doesn’t contain a race condition. Exploit the mechanism’s broken cryptography by sending carefully timed requests. To solve the lab Identify the vulnerability in the way the website generates password reset tokens, Obtain a valid password reset token for the user carlos, Log in as carlos and access the admin panel and delete the user carlos | Karthikeyan Nagarajhttps://medium.com/media/b60ae7f74e3834e983a967ae8b969dd0/hrefDescription This lab contains a password reset mechanism. Although it doesn’t contain a race condition, you can exploit the mechanism’s broken cryptography by sending carefully timed requests. To solve the lab:Identify the vulnerability in the way the website generates password reset tokens.Obtain a valid password reset token for the user carlos.Log in as carlos.Access the admin panel and delete the user carlos. You can log into your account with the following credentials: wiener:peter.SolutionNavigate to My Account and click Forgot Password.Type wiener, send the request, then capture the request and send it to the repeater 2 times.In one of the tabs in the repeater, Change POST to GET, Remove PHP session Cookie, Remove the Body — CSRF and Username and send the request.In the response, you’ll get a new session value and CSRF token, use the search functionality in the response and search it.Now, Undo the changes in request and replace the new session cookie and CSRF Value.You can easily get this by sending the get /forgot-password, but I’m just sharing my method, that will be easier than this if you understand (Use the Video for Better Understanding).Add the two requests into a group and change the value of the username to Carlos in one of the requests.Check your email Client, you would have received an email.Copy and paste the link in a new tab, replace the values of username to carlos, and hit Enter.You will now see the page to change the password for user carlos.Now Log in to carlos Account with the password that you created.Navigate to Admin Panel and delete user Carlos to solve the Lab If you receive an HTTP/1 version error, then send the request separately once and then send it in Group parallelly A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.5 Lab: Exploiting time-sensitive vulnerabilities | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

9.4 Lab: Single-endpoint race conditions | 2024

This lab’s email change feature contains a race condition that enables you to associate an arbitrary email address with your account. Someone with the address carlos@ginandjuice.shop has a pending invite to be an administrator for the site, but they have not yet created an account. Therefore, any user who successfully claims this address will automatically inherit admin privileges | Karthikeyan Nagarajhttps://medium.com/media/a119f88574955627e045bb01dcc99a37/hrefDescription This lab’s email change feature contains a race condition that enables you to associate an arbitrary email address with your account. Someone with the address carlos@ginandjuice.shop has a pending invite to be an administrator for the site, but they have not yet created an account. Therefore, any user who successfully claims this address will automatically inherit admin privileges. To solve the lab:Identify a race condition that lets you claim an arbitrary email address.Change your email address to carlos@ginandjuice.shop.Access the admin panel.Delete the user carlos You can log in to your own account with the following credentials: wiener:peter. You also have access to an email client, where you can view all emails sent to @exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net addresses.SolutionLog in to your Account with wiener:peterChange the Email to something@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net addresses.Capture the Above request and send it to the repeater 2 TimesChange the email ID for one of the requests to carlos@ginandjuice.shopRight-click, add the 2 requests to a Group, and send the Request in Parallel.Check your email client whether you have received an email that consists carlost@ginandjuice.shop.Click that link to change your mail, if not again send the parallel request to get the link.Then, navigate to My-Account, you can now able to see the Admin panel.Click on Admin Panel and delete the User Carlos to solve the Lab A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ngSingle endpoint race conditions by Karthikeyan Nagaraj 9.4 Lab: Single-endpoint race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

9.2 Lab: Bypassing rate limits via race conditions | 2024

This lab’s login mechanism uses rate limiting to defend against brute-force attacks. However, this can be bypassed due to a race condition. To solve the lab, bypass the rate limit. Successfully brute-force the password for the user carlos. Log in and access the admin panel and delete the user carlos | Karthikeyan Nagarajhttps://medium.com/media/2b6b73ca789c066c3b83ed6e1487a174/href This lab’s login mechanism uses rate limiting to defend against brute-force attacks. However, this can be bypassed due to a race condition. To solve the lab:Work out how to exploit the race condition to bypass the rate limit.Successfully brute-force the password for the user carlos.Log in and access the admin panel.Delete the user carlos. You can log in to your account with the following credentials: wiener:peter. You should use the following list of potential passwords:123123abc123footballmonkeyletmeinshadowmaster666666qwertyuiop123321mustang123456password12345678qwerty1234567891234512341111111234567dragon1234567890michaelx654321superman1qaz2wsxbaseball7777777121212000000SolutionTry to log in with the username Carlos with a wrong password and Capture the request.Send it to Repeater for Testing.Install Turbo Intruder in Extensions → BAPP Store.In Repeater, select the value of the password, Right click → Extensions → Turb Intruder → Send to Turbo Intruder.Paste the below python code in the scriptdef queueRequests(target, wordlists): # as the target supports HTTP/2, use engine=Engine.BURP2 and concurrentConnections=1 for a single-packet attack engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=1, engine=Engine.BURP2 ) # assign the list of candidate passwords from your clipboard passwords = wordlists.clipboard # queue a login request using each password from the wordlist # the 'gate' argument withholds the final part of each request until engine.openGate() is invoked for password in passwords: engine.queue(target.req, password, gate='1') # once every request has been queued # invoke engine.openGate() to send all requests in the given gate simultaneously engine.openGate('1')def handleResponse(req, interesting): table.add(req) 6. Now, copy the passwords and start the Attack. 7. Check for the 302 status code, If not start the attack again or restart the lab and do the same. 8. Once you find the password, log into Carlos's Account — if it shows the timing, wait for some time, and login 9. Navigate to Admin Panel and delete the User Carlos to solve the Lab A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.2 Lab: Bypassing rate limits via race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

9.3 Lab: Multi-endpoint race conditions | 2024

This lab’s purchasing flow contains a race condition that enables you to purchase items for an unintended price. To solve the lab, successfully purchase a Lightweight L33t Leather Jacket. You can log into your account with the following credentials: wiener:peter | Karthikeyan Nagarajhttps://medium.com/media/ddf7f82887b7aa2d7766f24e26e7c516/hrefDescription This lab’s purchasing flow contains a race condition that enables you to purchase items for an unintended price. To solve the lab, successfully purchase a Lightweight L33t Leather Jacket. You can log into your account with the following credentials: wiener:peter.SolutionLog in to your Account with wiener:peterTurn on the Proxy On and Turn on the Intercept.Now, try to add a gift card to the cart and buy it.In Burp’s http history send the POST /cart Request and POST /cart/checkout Request to the Repeater.Right-click a tab and add it to a group.Then try to send the group request in Parallel, if you see an error for HTTP versions — then try to send the /cart request as a single request or By adding HTTP/2. (See the Above video for Reference)Now, again send the POST /cart Request and POST /cart/checkout Request to the Repeater. But change the value of product ID to 1 in /cart.So now we should have 4 requests in the repeater, make sure the 4 requests are in the same tab like/cart , /cart/checkout, /cart, /cart/checkoutNow remove the items in the cart and send the request in parallel.Do this continuously until the jacket is purchased. Then the lab will be solved. A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.3 Lab: Multi-endpoint race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...