Today is Bug bounty Tuesday, I will share with you about Jenkins Arbitrary File…Continue reading on Medium » (https://medium.com/@kerstan/jenkins-arbitrary-file-reading-vulnerability-cve-2024-23897-bug-bounty-tuesday-8e3a69443d9b?source=rss------bug_bounty-5)
Reconnaissance: A Google-Dorking Affair
High quality reconnaissance is a key skill in many areas of information security…Continue reading on Medium »
Read more...
High quality reconnaissance is a key skill in many areas of information security…Continue reading on Medium »
Read more...
Medium
Reconnaissance: A Google-Dorking Affair
High quality reconnaissance is a key skill in many areas of information security…
Reconnaissance: A Google-Dorking Affair
https://medium.com/@kieran.x.willey/reconnaissance-a-google-dorking-affair-21edfb4e3b0f?source=rss------bug_bounty-5
https://medium.com/@kieran.x.willey/reconnaissance-a-google-dorking-affair-21edfb4e3b0f?source=rss------bug_bounty-5
High quality reconnaissance is a key skill in many areas of information security…Continue reading on Medium » (https://medium.com/@kieran.x.willey/reconnaissance-a-google-dorking-affair-21edfb4e3b0f?source=rss------bug_bounty-5)
The Exploitation of Massive Slack Workspaces Registration Vulnerability
Greetings, fellow cyber voyagers!Continue reading on Medium »
Read more...
Greetings, fellow cyber voyagers!Continue reading on Medium »
Read more...
The Exploitation of Massive Slack Workspaces Registration Vulnerability
https://medium.com/@siratsami71/the-exploitation-of-massive-slack-workspaces-registration-vulnerability-0c0e76e5cd3e?source=rss------bug_bounty-5
https://medium.com/@siratsami71/the-exploitation-of-massive-slack-workspaces-registration-vulnerability-0c0e76e5cd3e?source=rss------bug_bounty-5
Greetings, fellow cyber voyagers!Continue reading on Medium » (https://medium.com/@siratsami71/the-exploitation-of-massive-slack-workspaces-registration-vulnerability-0c0e76e5cd3e?source=rss------bug_bounty-5)
CVE-2023–40000: How Safe Is Your Internet Box? ️
Cisco Device Hack Alarms Web WorldContinue reading on Coded Tech Talk »
Read more...
Cisco Device Hack Alarms Web WorldContinue reading on Coded Tech Talk »
Read more...
CVE-2023–40000: How Safe Is Your Internet Box? ️
https://medium.com/coded-tech-talk/cve-2023-40000-how-safe-is-your-internet-box-%EF%B8%8F-06ff1f872f7b?source=rss------bug_bounty-5
https://medium.com/coded-tech-talk/cve-2023-40000-how-safe-is-your-internet-box-%EF%B8%8F-06ff1f872f7b?source=rss------bug_bounty-5
Cisco Device Hack Alarms Web WorldContinue reading on Coded Tech Talk » (https://medium.com/coded-tech-talk/cve-2023-40000-how-safe-is-your-internet-box-%EF%B8%8F-06ff1f872f7b?source=rss------bug_bounty-5)
9.5 Lab: Exploiting time-sensitive vulnerabilities | 2024
This lab contains a password reset mechanism. Although it doesn’t contain a race condition. Exploit the mechanism’s broken cryptography by sending carefully timed requests. To solve the lab Identify the vulnerability in the way the website generates password reset tokens, Obtain a valid password reset token for the user carlos, Log in as carlos and access the admin panel and delete the user carlos | Karthikeyan Nagarajhttps://medium.com/media/b60ae7f74e3834e983a967ae8b969dd0/hrefDescription This lab contains a password reset mechanism. Although it doesn’t contain a race condition, you can exploit the mechanism’s broken cryptography by sending carefully timed requests. To solve the lab:Identify the vulnerability in the way the website generates password reset tokens.Obtain a valid password reset token for the user carlos.Log in as carlos.Access the admin panel and delete the user carlos. You can log into your account with the following credentials: wiener:peter.SolutionNavigate to My Account and click Forgot Password.Type wiener, send the request, then capture the request and send it to the repeater 2 times.In one of the tabs in the repeater, Change POST to GET, Remove PHP session Cookie, Remove the Body — CSRF and Username and send the request.In the response, you’ll get a new session value and CSRF token, use the search functionality in the response and search it.Now, Undo the changes in request and replace the new session cookie and CSRF Value.You can easily get this by sending the get /forgot-password, but I’m just sharing my method, that will be easier than this if you understand (Use the Video for Better Understanding).Add the two requests into a group and change the value of the username to Carlos in one of the requests.Check your email Client, you would have received an email.Copy and paste the link in a new tab, replace the values of username to carlos, and hit Enter.You will now see the page to change the password for user carlos.Now Log in to carlos Account with the password that you created.Navigate to Admin Panel and delete user Carlos to solve the Lab If you receive an HTTP/1 version error, then send the request separately once and then send it in Group parallelly A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.5 Lab: Exploiting time-sensitive vulnerabilities | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
This lab contains a password reset mechanism. Although it doesn’t contain a race condition. Exploit the mechanism’s broken cryptography by sending carefully timed requests. To solve the lab Identify the vulnerability in the way the website generates password reset tokens, Obtain a valid password reset token for the user carlos, Log in as carlos and access the admin panel and delete the user carlos | Karthikeyan Nagarajhttps://medium.com/media/b60ae7f74e3834e983a967ae8b969dd0/hrefDescription This lab contains a password reset mechanism. Although it doesn’t contain a race condition, you can exploit the mechanism’s broken cryptography by sending carefully timed requests. To solve the lab:Identify the vulnerability in the way the website generates password reset tokens.Obtain a valid password reset token for the user carlos.Log in as carlos.Access the admin panel and delete the user carlos. You can log into your account with the following credentials: wiener:peter.SolutionNavigate to My Account and click Forgot Password.Type wiener, send the request, then capture the request and send it to the repeater 2 times.In one of the tabs in the repeater, Change POST to GET, Remove PHP session Cookie, Remove the Body — CSRF and Username and send the request.In the response, you’ll get a new session value and CSRF token, use the search functionality in the response and search it.Now, Undo the changes in request and replace the new session cookie and CSRF Value.You can easily get this by sending the get /forgot-password, but I’m just sharing my method, that will be easier than this if you understand (Use the Video for Better Understanding).Add the two requests into a group and change the value of the username to Carlos in one of the requests.Check your email Client, you would have received an email.Copy and paste the link in a new tab, replace the values of username to carlos, and hit Enter.You will now see the page to change the password for user carlos.Now Log in to carlos Account with the password that you created.Navigate to Admin Panel and delete user Carlos to solve the Lab If you receive an HTTP/1 version error, then send the request separately once and then send it in Group parallelly A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.5 Lab: Exploiting time-sensitive vulnerabilities | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
9.5 Lab: Exploiting time-sensitive vulnerabilities | 2024
This lab contains a password reset mechanism. Although it doesn’t contain a race condition. Exploit the mechanism’s broken cryptography by…
9.4 Lab: Single-endpoint race conditions | 2024
This lab’s email change feature contains a race condition that enables you to associate an arbitrary email address with your account. Someone with the address carlos@ginandjuice.shop has a pending invite to be an administrator for the site, but they have not yet created an account. Therefore, any user who successfully claims this address will automatically inherit admin privileges | Karthikeyan Nagarajhttps://medium.com/media/a119f88574955627e045bb01dcc99a37/hrefDescription This lab’s email change feature contains a race condition that enables you to associate an arbitrary email address with your account. Someone with the address carlos@ginandjuice.shop has a pending invite to be an administrator for the site, but they have not yet created an account. Therefore, any user who successfully claims this address will automatically inherit admin privileges. To solve the lab:Identify a race condition that lets you claim an arbitrary email address.Change your email address to carlos@ginandjuice.shop.Access the admin panel.Delete the user carlos You can log in to your own account with the following credentials: wiener:peter. You also have access to an email client, where you can view all emails sent to @exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net addresses.SolutionLog in to your Account with wiener:peterChange the Email to something@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net addresses.Capture the Above request and send it to the repeater 2 TimesChange the email ID for one of the requests to carlos@ginandjuice.shopRight-click, add the 2 requests to a Group, and send the Request in Parallel.Check your email client whether you have received an email that consists carlost@ginandjuice.shop.Click that link to change your mail, if not again send the parallel request to get the link.Then, navigate to My-Account, you can now able to see the Admin panel.Click on Admin Panel and delete the User Carlos to solve the Lab A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ngSingle endpoint race conditions by Karthikeyan Nagaraj 9.4 Lab: Single-endpoint race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
This lab’s email change feature contains a race condition that enables you to associate an arbitrary email address with your account. Someone with the address carlos@ginandjuice.shop has a pending invite to be an administrator for the site, but they have not yet created an account. Therefore, any user who successfully claims this address will automatically inherit admin privileges | Karthikeyan Nagarajhttps://medium.com/media/a119f88574955627e045bb01dcc99a37/hrefDescription This lab’s email change feature contains a race condition that enables you to associate an arbitrary email address with your account. Someone with the address carlos@ginandjuice.shop has a pending invite to be an administrator for the site, but they have not yet created an account. Therefore, any user who successfully claims this address will automatically inherit admin privileges. To solve the lab:Identify a race condition that lets you claim an arbitrary email address.Change your email address to carlos@ginandjuice.shop.Access the admin panel.Delete the user carlos You can log in to your own account with the following credentials: wiener:peter. You also have access to an email client, where you can view all emails sent to @exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net addresses.SolutionLog in to your Account with wiener:peterChange the Email to something@exploit-<YOUR-EXPLOIT-SERVER-ID>.exploit-server.net addresses.Capture the Above request and send it to the repeater 2 TimesChange the email ID for one of the requests to carlos@ginandjuice.shopRight-click, add the 2 requests to a Group, and send the Request in Parallel.Check your email client whether you have received an email that consists carlost@ginandjuice.shop.Click that link to change your mail, if not again send the parallel request to get the link.Then, navigate to My-Account, you can now able to see the Admin panel.Click on Admin Panel and delete the User Carlos to solve the Lab A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ngSingle endpoint race conditions by Karthikeyan Nagaraj 9.4 Lab: Single-endpoint race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
9.4 Lab: Single-endpoint race conditions | 2024
This lab’s email change feature contains a race condition that enables you to associate an arbitrary email address with your account…
9.2 Lab: Bypassing rate limits via race conditions | 2024
This lab’s login mechanism uses rate limiting to defend against brute-force attacks. However, this can be bypassed due to a race condition. To solve the lab, bypass the rate limit. Successfully brute-force the password for the user carlos. Log in and access the admin panel and delete the user carlos | Karthikeyan Nagarajhttps://medium.com/media/2b6b73ca789c066c3b83ed6e1487a174/href This lab’s login mechanism uses rate limiting to defend against brute-force attacks. However, this can be bypassed due to a race condition. To solve the lab:Work out how to exploit the race condition to bypass the rate limit.Successfully brute-force the password for the user carlos.Log in and access the admin panel.Delete the user carlos. You can log in to your account with the following credentials: wiener:peter. You should use the following list of potential passwords:123123abc123footballmonkeyletmeinshadowmaster666666qwertyuiop123321mustang123456password12345678qwerty1234567891234512341111111234567dragon1234567890michaelx654321superman1qaz2wsxbaseball7777777121212000000SolutionTry to log in with the username Carlos with a wrong password and Capture the request.Send it to Repeater for Testing.Install Turbo Intruder in Extensions → BAPP Store.In Repeater, select the value of the password, Right click → Extensions → Turb Intruder → Send to Turbo Intruder.Paste the below python code in the scriptdef queueRequests(target, wordlists): # as the target supports HTTP/2, use engine=Engine.BURP2 and concurrentConnections=1 for a single-packet attack engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=1, engine=Engine.BURP2 ) # assign the list of candidate passwords from your clipboard passwords = wordlists.clipboard # queue a login request using each password from the wordlist # the 'gate' argument withholds the final part of each request until engine.openGate() is invoked for password in passwords: engine.queue(target.req, password, gate='1') # once every request has been queued # invoke engine.openGate() to send all requests in the given gate simultaneously engine.openGate('1')def handleResponse(req, interesting): table.add(req) 6. Now, copy the passwords and start the Attack. 7. Check for the 302 status code, If not start the attack again or restart the lab and do the same. 8. Once you find the password, log into Carlos's Account — if it shows the timing, wait for some time, and login 9. Navigate to Admin Panel and delete the User Carlos to solve the Lab A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.2 Lab: Bypassing rate limits via race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
This lab’s login mechanism uses rate limiting to defend against brute-force attacks. However, this can be bypassed due to a race condition. To solve the lab, bypass the rate limit. Successfully brute-force the password for the user carlos. Log in and access the admin panel and delete the user carlos | Karthikeyan Nagarajhttps://medium.com/media/2b6b73ca789c066c3b83ed6e1487a174/href This lab’s login mechanism uses rate limiting to defend against brute-force attacks. However, this can be bypassed due to a race condition. To solve the lab:Work out how to exploit the race condition to bypass the rate limit.Successfully brute-force the password for the user carlos.Log in and access the admin panel.Delete the user carlos. You can log in to your account with the following credentials: wiener:peter. You should use the following list of potential passwords:123123abc123footballmonkeyletmeinshadowmaster666666qwertyuiop123321mustang123456password12345678qwerty1234567891234512341111111234567dragon1234567890michaelx654321superman1qaz2wsxbaseball7777777121212000000SolutionTry to log in with the username Carlos with a wrong password and Capture the request.Send it to Repeater for Testing.Install Turbo Intruder in Extensions → BAPP Store.In Repeater, select the value of the password, Right click → Extensions → Turb Intruder → Send to Turbo Intruder.Paste the below python code in the scriptdef queueRequests(target, wordlists): # as the target supports HTTP/2, use engine=Engine.BURP2 and concurrentConnections=1 for a single-packet attack engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=1, engine=Engine.BURP2 ) # assign the list of candidate passwords from your clipboard passwords = wordlists.clipboard # queue a login request using each password from the wordlist # the 'gate' argument withholds the final part of each request until engine.openGate() is invoked for password in passwords: engine.queue(target.req, password, gate='1') # once every request has been queued # invoke engine.openGate() to send all requests in the given gate simultaneously engine.openGate('1')def handleResponse(req, interesting): table.add(req) 6. Now, copy the passwords and start the Attack. 7. Check for the 302 status code, If not start the attack again or restart the lab and do the same. 8. Once you find the password, log into Carlos's Account — if it shows the timing, wait for some time, and login 9. Navigate to Admin Panel and delete the User Carlos to solve the Lab A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.2 Lab: Bypassing rate limits via race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
9.2 Lab: Bypassing rate limits via race conditions | 2024
This lab’s login mechanism uses rate limiting to defend against brute-force attacks. However, this can be bypassed due to a race condition…
9.3 Lab: Multi-endpoint race conditions | 2024
This lab’s purchasing flow contains a race condition that enables you to purchase items for an unintended price. To solve the lab, successfully purchase a Lightweight L33t Leather Jacket. You can log into your account with the following credentials: wiener:peter | Karthikeyan Nagarajhttps://medium.com/media/ddf7f82887b7aa2d7766f24e26e7c516/hrefDescription This lab’s purchasing flow contains a race condition that enables you to purchase items for an unintended price. To solve the lab, successfully purchase a Lightweight L33t Leather Jacket. You can log into your account with the following credentials: wiener:peter.SolutionLog in to your Account with wiener:peterTurn on the Proxy On and Turn on the Intercept.Now, try to add a gift card to the cart and buy it.In Burp’s http history send the POST /cart Request and POST /cart/checkout Request to the Repeater.Right-click a tab and add it to a group.Then try to send the group request in Parallel, if you see an error for HTTP versions — then try to send the /cart request as a single request or By adding HTTP/2. (See the Above video for Reference)Now, again send the POST /cart Request and POST /cart/checkout Request to the Repeater. But change the value of product ID to 1 in /cart.So now we should have 4 requests in the repeater, make sure the 4 requests are in the same tab like/cart , /cart/checkout, /cart, /cart/checkoutNow remove the items in the cart and send the request in parallel.Do this continuously until the jacket is purchased. Then the lab will be solved. A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.3 Lab: Multi-endpoint race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
This lab’s purchasing flow contains a race condition that enables you to purchase items for an unintended price. To solve the lab, successfully purchase a Lightweight L33t Leather Jacket. You can log into your account with the following credentials: wiener:peter | Karthikeyan Nagarajhttps://medium.com/media/ddf7f82887b7aa2d7766f24e26e7c516/hrefDescription This lab’s purchasing flow contains a race condition that enables you to purchase items for an unintended price. To solve the lab, successfully purchase a Lightweight L33t Leather Jacket. You can log into your account with the following credentials: wiener:peter.SolutionLog in to your Account with wiener:peterTurn on the Proxy On and Turn on the Intercept.Now, try to add a gift card to the cart and buy it.In Burp’s http history send the POST /cart Request and POST /cart/checkout Request to the Repeater.Right-click a tab and add it to a group.Then try to send the group request in Parallel, if you see an error for HTTP versions — then try to send the /cart request as a single request or By adding HTTP/2. (See the Above video for Reference)Now, again send the POST /cart Request and POST /cart/checkout Request to the Repeater. But change the value of product ID to 1 in /cart.So now we should have 4 requests in the repeater, make sure the 4 requests are in the same tab like/cart , /cart/checkout, /cart, /cart/checkoutNow remove the items in the cart and send the request in parallel.Do this continuously until the jacket is purchased. Then the lab will be solved. A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups Cyberw1ng Telegram Channel for Free Ethical Hacking Dumps Ethical Hacking Dumps - CEH, OSCP, Comptia Thank you for Reading! Happy Ethical Hacking ~ Author: Karthikeyan Nagaraj ~ Cyberw1ng 9.3 Lab: Multi-endpoint race conditions | 2024 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
9.3 Lab: Multi-endpoint race conditions | 2024
This lab’s purchasing flow contains a race condition that enables you to purchase items for an unintended price. To solve the lab…
This is the easiest bug you can find right now.
API key disclosure in JS file (website entity hidden)Small Intro: If you are new here, I am a beginner bug hunter and cyber security enthusiast, I am currently learning bug hunting. Connect me on LinkedIn and Twitter for amazing tips and tricks! You have probably clicked after the title, yes it is true! The bug I am going to discuss is the most easiest bug you can find and report, Let’s get started!Introduction: Every website is written in lines of codes, In basic, a website is comprised on 3 main languages:Html: Structure of the websiteCSS: Styling and User InterfaceJavaScript: Make web pages interactive You can see the source code by pressing “Ctrl + U” but but but, sometimes these JS files can show some very vulnerable information without any encryption. This information includes usernames, passwords, credentials, API keys etc. This vulnerability can be reported and can result in bounty or swag.Finding misconfigured JS files information: Ok so, Finding this vulnerability consist of 2 parts, first is finding all JS files of that website, second is finding misconfigured information from that extracted JS files.Finding JS files: For finding all JS files there are two most popular tools for this i.e. SubJS and Katana. In this article I am going to cover Katana First Step: Install KatanaKatana GitHub Page Install from here (GitHub) Katana can be installed by git clone. I am not gonna tell that installation in this blog. Second Step: Run Commandkatana -list {domains.txt} -d 5 -jc | grep ".js$" | uniq | sort Run this command to run katana for finding all JS files of provided list of domains. Remember to add your list of subdomains of a particular website in place of {domains.txt} & configure it for your own ease. It will show something like this:Started Crawling And after some crawling it will show JS files. Remember to save them. Third Step: Extracting sensitive information from JS files For extracting all sensitive information we will be using a tool called SecretFinder. Download SecretFinder (GitHub) Now after installing SecretFinder then run the following commandcat {jsfilesgottenfromkatana.txt} | while read url; do python3SecretFinder/SecretFinder.py -i $url -o cli; done And it will display all possible credentials of all provided JS files fetched from katanaPossible Credentials If anything sensitive found report it. I hope this blog helped you in finding a bug! Remember to follow me, for more amazing blogs! This is the easiest bug you can find right now. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
API key disclosure in JS file (website entity hidden)Small Intro: If you are new here, I am a beginner bug hunter and cyber security enthusiast, I am currently learning bug hunting. Connect me on LinkedIn and Twitter for amazing tips and tricks! You have probably clicked after the title, yes it is true! The bug I am going to discuss is the most easiest bug you can find and report, Let’s get started!Introduction: Every website is written in lines of codes, In basic, a website is comprised on 3 main languages:Html: Structure of the websiteCSS: Styling and User InterfaceJavaScript: Make web pages interactive You can see the source code by pressing “Ctrl + U” but but but, sometimes these JS files can show some very vulnerable information without any encryption. This information includes usernames, passwords, credentials, API keys etc. This vulnerability can be reported and can result in bounty or swag.Finding misconfigured JS files information: Ok so, Finding this vulnerability consist of 2 parts, first is finding all JS files of that website, second is finding misconfigured information from that extracted JS files.Finding JS files: For finding all JS files there are two most popular tools for this i.e. SubJS and Katana. In this article I am going to cover Katana First Step: Install KatanaKatana GitHub Page Install from here (GitHub) Katana can be installed by git clone. I am not gonna tell that installation in this blog. Second Step: Run Commandkatana -list {domains.txt} -d 5 -jc | grep ".js$" | uniq | sort Run this command to run katana for finding all JS files of provided list of domains. Remember to add your list of subdomains of a particular website in place of {domains.txt} & configure it for your own ease. It will show something like this:Started Crawling And after some crawling it will show JS files. Remember to save them. Third Step: Extracting sensitive information from JS files For extracting all sensitive information we will be using a tool called SecretFinder. Download SecretFinder (GitHub) Now after installing SecretFinder then run the following commandcat {jsfilesgottenfromkatana.txt} | while read url; do python3SecretFinder/SecretFinder.py -i $url -o cli; done And it will display all possible credentials of all provided JS files fetched from katanaPossible Credentials If anything sensitive found report it. I hope this blog helped you in finding a bug! Remember to follow me, for more amazing blogs! This is the easiest bug you can find right now. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
Introduction:
Uncover JavaScript Vulnerabilities: Harness Katana and SecretFinder. Learn to safeguard your code against threats. Enhance web app security now!
how i made easy information disclosure bugs in graphql
this is a way to find easy information disclosure bugs in any graphql api that uses postgresql database Hi everyone 😉 always remember that you… but today we are talking about a website with database. lets call the website “example.com” what can i do in example.com?see on every parameter if it goes throught the database or not.get the database query if errors are visible in the response, such as:“select * from passwords where password = mypassword”know if parameter have the potential of being vulnerable to sqli. or if the parameter is prepered statment (if error shown witch is very common).but why i can do all this thing? The reason that you are able to do all of those thing is because every website that builtin using nodejs, graphql, and postgresql is vulnerable by default! to something that i call “null byte injection”.what is “null byte injection”? null byte injection is simply adding null byte to the string. such as \u0000 or %00 or any other way that the program will read a null byte. lets see an example of error that i have gotten by adding null byte to the request:this is not the same website that i reported to bugcrowdbug after sent to bugcrowd programbonous on every website that vulnerable to above vulnerability its very easy to check for sqli. not only this, also when we get sqli its very easy to know what explait we need to insert because we see the query. lets say that we found sqli, with postgresql its very very easy can escalate to full RCE vulnerability! as you can execute below query:COPY table_name (columnname) FROM PROGRAM 'echo "i am executing bash"' how i made easy information disclosure bugs in graphql was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
[Read more...](https://infosecwriteups.com/how-i-made-easy-information-disclosure-bugs-in-graphql-82284b05d7b4?source=rss----7b722bfd1b8d--bugbounty)
this is a way to find easy information disclosure bugs in any graphql api that uses postgresql database Hi everyone 😉 always remember that you… but today we are talking about a website with database. lets call the website “example.com” what can i do in example.com?see on every parameter if it goes throught the database or not.get the database query if errors are visible in the response, such as:“select * from passwords where password = mypassword”know if parameter have the potential of being vulnerable to sqli. or if the parameter is prepered statment (if error shown witch is very common).but why i can do all this thing? The reason that you are able to do all of those thing is because every website that builtin using nodejs, graphql, and postgresql is vulnerable by default! to something that i call “null byte injection”.what is “null byte injection”? null byte injection is simply adding null byte to the string. such as \u0000 or %00 or any other way that the program will read a null byte. lets see an example of error that i have gotten by adding null byte to the request:this is not the same website that i reported to bugcrowdbug after sent to bugcrowd programbonous on every website that vulnerable to above vulnerability its very easy to check for sqli. not only this, also when we get sqli its very easy to know what explait we need to insert because we see the query. lets say that we found sqli, with postgresql its very very easy can escalate to full RCE vulnerability! as you can execute below query:COPY table_name (columnname) FROM PROGRAM 'echo "i am executing bash"' how i made easy information disclosure bugs in graphql was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
[Read more...](https://infosecwriteups.com/how-i-made-easy-information-disclosure-bugs-in-graphql-82284b05d7b4?source=rss----7b722bfd1b8d--bugbounty)
Medium
how i made easy information disclosure bugs in graphql
this is a way to find easy information disclosure bugs in any graphql api that uses postgresql database
Mastering BetterCap: A Beginner’s Guide to Network Attacks and Monitoring
Dive into the world of cybersecurity with our beginner’s guide to BetterCap, the Swiss Army knife for network attacks and monitoring.Continue reading on InfoSec Write-ups »
Read more...
Dive into the world of cybersecurity with our beginner’s guide to BetterCap, the Swiss Army knife for network attacks and monitoring.Continue reading on InfoSec Write-ups »
Read more...
Medium
Mastering BetterCap: A Beginner’s Guide to Network Attacks and Monitoring
Dive into the world of cybersecurity with our beginner’s guide to BetterCap, the Swiss Army knife for network attacks and monitoring. Learn…
Dorking-Pentesting: Create Your Own Automated Google Dorking Based Pentesting Tools
Explore the intricacies of an automated pentesting tool designed to detect web vulnerabilities with Google Dorks, including SQL Injection…Continue reading on InfoSec Write-ups »
Read more...
Explore the intricacies of an automated pentesting tool designed to detect web vulnerabilities with Google Dorks, including SQL Injection…Continue reading on InfoSec Write-ups »
Read more...
Medium
Dorking-Pentesting: Create Your Own Automated Google Dorking Based Pentesting Tools
Explore the intricacies of an automated pentesting tool designed to detect web vulnerabilities with Google Dorks, including SQL Injection…