New 100$ Bug in My Methodology!
Hello everyone! I’m Rem and I’m 23 years old. I’m here to describe my new bug.Continue reading on Medium »
Read more...
Hello everyone! I’m Rem and I’m 23 years old. I’m here to describe my new bug.Continue reading on Medium »
Read more...
Medium
New 100$ Bug in My Methodology!
Hello everyone! I’m Rem and I’m 23 years old. I’m here to describe my new bug. This bug is very amazing to me and I think some people might…
New 100$ Bug in My Methodology!
https://medium.com/@rewmcode/new-100-bug-in-my-methodology-60d99f0dafe2?source=rss------bug_bounty-5
https://medium.com/@rewmcode/new-100-bug-in-my-methodology-60d99f0dafe2?source=rss------bug_bounty-5
Hello everyone! I’m Rem and I’m 23 years old. I’m here to describe my new bug.Continue reading on Medium » (https://medium.com/@rewmcode/new-100-bug-in-my-methodology-60d99f0dafe2?source=rss------bug_bounty-5)
Duplicate P1 in public program
summary: I found a subdomain with no functions, by fuzzing I found register and login function but it allows only employees.Continue reading on Medium »
Read more...
summary: I found a subdomain with no functions, by fuzzing I found register and login function but it allows only employees.Continue reading on Medium »
Read more...
Medium
Duplicate P1 in public program
summary:
I found a subdomain with no functions, by fuzzing I found register and login function but it allows only employees.
I attempted to…
I found a subdomain with no functions, by fuzzing I found register and login function but it allows only employees.
I attempted to…
🚩 CTF Challenge: Exploiting a Vulnerable Calculator Web App. Can you solve this challenge ?
https://www.reddit.com/r/Pentesting/comments/1dmtfcf/ctf_challenge_exploiting_a_vulnerable_calculator/
<!-- SC_OFF -->We have a web application written in C++ for the backend and JavaScript for the frontend. Questions: what is the vulnerability in this program ? What would be the payload syntax that would show the content of the /etc/passwd file? Vulnerable Calculator Web App code : ```cpp include include include include include const char *html_template = R"HTML( <!DOCTYPE html> Calculator Simple Calculator Calculate Result: function calculate() { const expression = document.getElementById('expression').value; fetch(/calculator?expr=${encodeURIComponent(expression)}) .then(response => response.json()) .then(data => { document.getElementById('result').innerText = data.result; }) .catch(error => { document.getElementById('result').innerText = 'Error'; }); } )HTML"; int main() { while (FCGI_Accept() >= 0) { std::string request_uri = getenv("REQUEST_URI"); if (request_uri == "/") { std::cout << "Status: 200 OK\r\n" << "Content-Type: text/html\r\n\r\n" << html_template; } else if (request_uri.find("/calculator?expr=") != std::string::npos) { std::string query_string = getenv("QUERY_STRING"); std::string expr = query_string.substr(query_string.find("expr=") + 5); std::string command = "echo " + expr + " | bc"; FILE *fp = popen(command.c_str(), "r"); if (fp == NULL) { std::cout << "Status: 500 Internal Server Error\r\n" << "Content-Type: text/html\r\n\r\n" << "500 Internal Server Error"; continue; } char buffer[128]; std::string result = ""; while (fgets(buffer, sizeof(buffer), fp) != NULL) { result += buffer; } pclose(fp); std::cout << "Status: 200 OK\r\n" << "Content-Type: application/json\r\n\r\n" << "{\"result\": \"" << result << "\"}"; } } return 0; } ``` feel free to ask any questions or share your experiences! Happy hacking! 🔥💻 <!-- SC_ON --> submitted by /u/sagarbiswas1 (https://www.reddit.com/user/sagarbiswas1)
[link] (https://www.reddit.com/r/Pentesting/comments/1dmtfcf/ctf_challenge_exploiting_a_vulnerable_calculator/) [comments] (https://www.reddit.com/r/Pentesting/comments/1dmtfcf/ctf_challenge_exploiting_a_vulnerable_calculator/)
https://www.reddit.com/r/Pentesting/comments/1dmtfcf/ctf_challenge_exploiting_a_vulnerable_calculator/
<!-- SC_OFF -->We have a web application written in C++ for the backend and JavaScript for the frontend. Questions: what is the vulnerability in this program ? What would be the payload syntax that would show the content of the /etc/passwd file? Vulnerable Calculator Web App code : ```cpp include include include include include const char *html_template = R"HTML( <!DOCTYPE html> Calculator Simple Calculator Calculate Result: function calculate() { const expression = document.getElementById('expression').value; fetch(/calculator?expr=${encodeURIComponent(expression)}) .then(response => response.json()) .then(data => { document.getElementById('result').innerText = data.result; }) .catch(error => { document.getElementById('result').innerText = 'Error'; }); } )HTML"; int main() { while (FCGI_Accept() >= 0) { std::string request_uri = getenv("REQUEST_URI"); if (request_uri == "/") { std::cout << "Status: 200 OK\r\n" << "Content-Type: text/html\r\n\r\n" << html_template; } else if (request_uri.find("/calculator?expr=") != std::string::npos) { std::string query_string = getenv("QUERY_STRING"); std::string expr = query_string.substr(query_string.find("expr=") + 5); std::string command = "echo " + expr + " | bc"; FILE *fp = popen(command.c_str(), "r"); if (fp == NULL) { std::cout << "Status: 500 Internal Server Error\r\n" << "Content-Type: text/html\r\n\r\n" << "500 Internal Server Error"; continue; } char buffer[128]; std::string result = ""; while (fgets(buffer, sizeof(buffer), fp) != NULL) { result += buffer; } pclose(fp); std::cout << "Status: 200 OK\r\n" << "Content-Type: application/json\r\n\r\n" << "{\"result\": \"" << result << "\"}"; } } return 0; } ``` feel free to ask any questions or share your experiences! Happy hacking! 🔥💻 <!-- SC_ON --> submitted by /u/sagarbiswas1 (https://www.reddit.com/user/sagarbiswas1)
[link] (https://www.reddit.com/r/Pentesting/comments/1dmtfcf/ctf_challenge_exploiting_a_vulnerable_calculator/) [comments] (https://www.reddit.com/r/Pentesting/comments/1dmtfcf/ctf_challenge_exploiting_a_vulnerable_calculator/)
Chaining bugs for Account Takeover
I’m going to share with you my second account takeover for which I was rewarded in the wonderful world of bug bounty hunting. I want to…Continue reading on Medium »
Read more...
I’m going to share with you my second account takeover for which I was rewarded in the wonderful world of bug bounty hunting. I want to…Continue reading on Medium »
Read more...
Medium
😎 Chaining bugs for Account Takeover
I’m going to share with you my second account takeover for which I was rewarded in the wonderful world of bug bounty hunting. I want to…
summary:
I found a subdomain with no functions, by fuzzing I found register and login function but it allows only employees.Continue reading on Medium » (https://medium.com/@mohamed.yasser442200/duplicate-p1-in-public-program-aa9ade8f61c3?source=rss------bug_bounty-5)
I found a subdomain with no functions, by fuzzing I found register and login function but it allows only employees.Continue reading on Medium » (https://medium.com/@mohamed.yasser442200/duplicate-p1-in-public-program-aa9ade8f61c3?source=rss------bug_bounty-5)
Chaining bugs for Account Takeover
https://medium.com/@hbenja47/chaining-bugs-for-account-takeover-0b90a2d952af?source=rss------bug_bounty-5
https://medium.com/@hbenja47/chaining-bugs-for-account-takeover-0b90a2d952af?source=rss------bug_bounty-5
I’m going to share with you my second account takeover for which I was rewarded in the wonderful world of bug bounty hunting. I want to…Continue reading on Medium » (https://medium.com/@hbenja47/chaining-bugs-for-account-takeover-0b90a2d952af?source=rss------bug_bounty-5)
My First Bug Hunting Experience: A Journey from Disappointment to Success
Bug Bounty HuntingContinue reading on Medium »
Read more...
Bug Bounty HuntingContinue reading on Medium »
Read more...
Medium
My First Bug Hunting Experience: A Journey from Disappointment to Success
Bug Bounty Hunting
My First Bug Hunting Experience: A Journey from Disappointment to Success
https://b0mk35h.medium.com/my-first-bug-hunting-experience-a-journey-from-disappointment-to-success-ae92c222a0d0?source=rss------bug_bounty-5
https://b0mk35h.medium.com/my-first-bug-hunting-experience-a-journey-from-disappointment-to-success-ae92c222a0d0?source=rss------bug_bounty-5
Bug Bounty HuntingContinue reading on Medium » (https://b0mk35h.medium.com/my-first-bug-hunting-experience-a-journey-from-disappointment-to-success-ae92c222a0d0?source=rss------bug_bounty-5)
Roadmap to Becoming a Professional Penetration Tester with Estimated Learning Time
https://medium.com/@cuncis/roadmap-to-becoming-a-professional-penetration-tester-with-estimated-learning-time-d352bdd43fbe?source=rss------bug_bounty-5
https://medium.com/@cuncis/roadmap-to-becoming-a-professional-penetration-tester-with-estimated-learning-time-d352bdd43fbe?source=rss------bug_bounty-5
1. Understanding the BasicsContinue reading on Medium » (https://medium.com/@cuncis/roadmap-to-becoming-a-professional-penetration-tester-with-estimated-learning-time-d352bdd43fbe?source=rss------bug_bounty-5)
Unseen Dangers: How Cloud Misconfigurations Could Be Your Company’s Biggest Threat
https://medium.com/@paritoshblogs/unseen-dangers-how-cloud-misconfigurations-could-be-your-companys-biggest-threat-c1ed86b10093?source=rss------bug_bounty-5
https://medium.com/@paritoshblogs/unseen-dangers-how-cloud-misconfigurations-could-be-your-companys-biggest-threat-c1ed86b10093?source=rss------bug_bounty-5