Protocols:Continue reading on Medium » (https://medium.com/@rafid19/bug-bounty-hunting-complete-guide-part-7-6a8786ecb6f4?source=rss------bug_bounty-5)

Bug Bounty Hunting — Complete Guide (Part-8)

Hostname:Continue reading on Medium »
Read more...

Bug Bounty Hunting — Complete Guide (Part-8)
https://medium.com/@rafid19/bug-bounty-hunting-complete-guide-part-8-3d5a833a4842?source=rss------bug_bounty-5

Hostname:Continue reading on Medium » (https://medium.com/@rafid19/bug-bounty-hunting-complete-guide-part-8-3d5a833a4842?source=rss------bug_bounty-5)

13.30 Lab: Exploiting cross-site scripting to capture passwords
https://cyberw1ng.medium.com/13-30-lab-exploiting-cross-site-scripting-to-capture-passwords-bd3714035b4a?source=rss------bug_bounty-5

This lab contains a stored XSS vulnerability in the blog comments function. A simulated victim user views all comments after they are…Continue reading on Medium » (https://cyberw1ng.medium.com/13-30-lab-exploiting-cross-site-scripting-to-capture-passwords-bd3714035b4a?source=rss------bug_bounty-5)

13.30 Lab: Exploiting cross-site scripting to capture passwords

This lab contains a stored XSS vulnerability in the blog comments function. A simulated victim user views all comments after they are…Continue reading on Medium »
Read more...

Bypassing Reset Password ATO (Account takeover) through JavaScript Breakpoints

Hello Again, I hope you’re all having a great day filled with bugs to discover!😄 I am Ahmad Asaad a Penetration Tester & Bug bounty…Continue reading on Medium »
Read more...

Testing public package-lock.json available for a website
https://www.reddit.com/r/Pentesting/comments/1dn9utm/testing_public_packagelockjson_available_for_a/

<!-- SC_OFF -->Hello, Wanted to ask about the package-lock.json. This json is available for everybody on a specific website with all the specific npm version. How is possible to test if these npm version are vulnerable? Should I save that json file locally and then to try to test using npm for outdated version? Should this package-lock.json be available on a website? Thanks! <!-- SC_ON --> submitted by /u/Dry_Bird9633 (https://www.reddit.com/user/Dry_Bird9633)
[link] (https://www.reddit.com/r/Pentesting/comments/1dn9utm/testing_public_packagelockjson_available_for_a/) [comments] (https://www.reddit.com/r/Pentesting/comments/1dn9utm/testing_public_packagelockjson_available_for_a/)

Bypassing Reset Password ATO (Account takeover) through JavaScript Breakpoints
https://medium.com/@asaad0x/bypassing-reset-password-ato-account-takeover-through-javascript-breakpoints-e71187ad7171?source=rss------bug_bounty-5

Hello Again, 
I hope you’re all having a great day filled with bugs to discover!😄
I am Ahmad Asaad a Penetration Tester & Bug bounty…Continue reading on Medium » (https://medium.com/@asaad0x/bypassing-reset-password-ato-account-takeover-through-javascript-breakpoints-e71187ad7171?source=rss------bug_bounty-5)

OAuth CSRF: Exploiting the Authorization Code Flow for Account Takeover

Hello everyone! It’s cyberpro151 back with another writeup about an Account Takeover vulnerability that I found using CSRF vulnerability…Continue reading on Medium »
Read more...

Hfinger - Fingerprinting HTTP Requests
http://www.kitploit.com/2024/06/hfinger-fingerprinting-http-requests.html

Tool for Fingerprinting HTTP requests of malware. Based on Tshark and written in Python3. Working prototype stage :-) Its main objective is to provide unique representations (fingerprints) of malware requests, which help in their identification. Unique means here that each fingerprint should be seen only in one particular malware family, yet one family can have multiple fingerprints. Hfinger represents the request in a shorter form than printing the whole request, but still human interpretable. Hfinger can be used in manual malware analysis but also in sandbox systems or SIEMs. The generated fingerprints are useful for grouping requests, pinpointing requests to particular malware families, identifying different operations (https://www.kitploit.com/search/label/Operations) of one family, or discovering unknown malicious requests omitted by other security systems but which share fingerprint. An academic paper (https://www.mdpi.com/1099-4300/23/5/507/htm) accompanies work on this tool, describing, for example, the motivation of design choices, and the evaluation (https://www.kitploit.com/search/label/Evaluation) of the tool compared to p0f (https://lcamtuf.coredump.cx/p0f3/), FATT (https://github.com/0x4D31/fatt), and Mercury (https://github.com/cisco/mercury).
The idea The basic assumption of this project is that HTTP requests of different malware families are more or less unique, so they can be fingerprinted to provide some sort of identification. Hfinger retains information about the structure and values of some headers to provide means for further analysis. For example, grouping of similar requests - at this moment, it is still a work in progress. After analysis of malware's HTTP requests and headers, we have identified some parts of requests as being most distinctive. These include: * Request method * Protocol version * Header order * Popular headers' values * Payload length, entropy, and presence of non-ASCII characters Additionally, some standard features of the request URL were also considered. All these parts were translated into a set of features, described in details here (https://github.com/CERT-Polska/docs/feature_description.md). The above features are translated into varying length representation, which is the actual fingerprint. Depending on report mode, different features are used to fingerprint requests. More information on these modes is presented below. The feature selection process will be described in the forthcoming academic paper. Installation Minimum requirements needed before installation: * Python >= 3.3, * Tshark >= 2.2.0. Installation available from PyPI: pip install hfinger Hfinger has been tested on Xubuntu 22.04 LTS with tshark package in version 3.6.2, but should work with older versions like 2.6.10 on Xubuntu 18.04 or 3.2.3 on Xubuntu 20.04. Please note that as with any PoC, you should run Hfinger in a separated environment, at least with Python virtual environment. Its setup is not covered here, but you can try this tutorial (https://docs.python.org/3/library/venv.html). Usage After installation, you can call the tool directly from a command line with hfinger or as a Python module with python -m hfinger. For example: foo@bar:~$ hfinger -f /tmp/test.pcap
[{"epoch_time": "1614098832.205385000", "ip_src": "127.0.0.1", "ip_dst": "127.0.0.1", "port_src": "53664", "port_dst": "8080", "fingerprint": "2|3|1|php|0.6|PO|1|us-ag,ac,ac-en,ho,co,co-ty,co-le|us-ag:f452d7a9/ac:as-as/ac-en:id/co:Ke-Al/co-ty:te-pl|A|4|1.4"}]
Help can be displayed with short -h or long --help switches: usage: hfinger [-h] (-f FILE | -d DIR) [-o output_path] [-m {0,1,2,3,4}] [-v]
[-l LOGFILE]

Hfinger - fingerprinting malware HTTP requests stored in pcap files

optional arguments:
-h, --help show this help message and exit
-f FILE, --file FILE Read a single pcap file
-d DIR, --directory DIR
Read pcap files from the directory DIR

-o output_path, --output-path output_path
Path to the output directory
-m {0,1,2,3,4}, --mode {0,1,2,3,4}
Fingerprint report mode.
0 - similar number of collisions and fingerprints as mode 2, but using fewer features,
1 - representation of all designed features, but a little more collisions than modes 0, 2, and 4,
2 - optimal (the default mode),
3 - the lowest number of generated fingerprints, but the highest number of collisions,
4 - the highest fingerprint entropy, but slightly more fingerprints than modes 0-2
-v, --verbose Report information about non-standard values in the request
(e.g., non-ASCII characters, no CRLF tags, values not present in the configuration list).
Without --logfile (-l) will print to the standard error.
-l LOGFILE, --logfile LOGFILE
Output logfile in the verbose mode. Implies -v or --verbose switch.

You must provide a path to a pcap file (-f), or a directory (-d) with pcap files. The output is in JSON format. It will be printed to standard output or to the provided directory (-o) using the name of the source file. For example, output of the command: hfinger -f example.pcap -o /tmp/pcap will be saved to: /tmp/pcap/example.pcap.json Report mode -m/--mode can be used to change the default report mode by providing an integer in the range 0-4. The modes differ on represented request features or rounding modes. The default mode (2) was chosen by us to represent all features that are usually used during requests' analysis, but it also offers low number of collisions and generated fingerprints. With other modes, you can achieve different goals. For example, in mode 3 you get a lower number of generated fingerprints but a higher chance of a collision between malware families. If you are unsure, you don't have to change anything. More information on report modes is here (https://github.com/CERT-Polska/hfinger#report-modes). Beginning with version 0.2.1 Hfinger is less verbose. You should use -v/--verbose if you want to receive information about encountered non-standard values of headers, non-ASCII characters in the non-payload part of the request, lack of CRLF tags (\r\n\r\n), and other problems with analyzed requests that are not application errors. When any such issues are encountered in the verbose mode, they will be printed to the standard error output. You can also save the log to a defined location using -l/--log switch (it implies -v/--verbose). The log data will be appended to the log file. Using hfinger in a Python application Beginning with version 0.2.0, Hfinger supports importing to other Python applications. To use it in your app simply import hfinger_analyze function from hfinger.analysis and call it with a path to the pcap file and reporting mode. The returned result is a list of dicts with fingerprinting results. For example: from hfinger.analysis import hfinger_analyze

pcap_path = "SPECIFY_PCAP_PATH_HERE"
reporting_mode = 4
print(hfinger_analyze(pcap_path, reporting_mode))
Beginning with version 0.2.1 Hfinger uses logging module for logging information about encountered non-standard values of headers, non-ASCII characters in the non-payload part of the request, lack of CRLF tags (\r\n\r\n), and other problems with analyzed requests that are not application errors. Hfinger creates its own logger using name hfinger, but without prior configuration (https://www.kitploit.com/search/label/Configuration) log information in practice is discarded. If you want to receive this log information, before calling hfinger_analyze, you should configure hfinger logger, set log level to logging.INFO, configure log handler up to your needs, add it to the logger. More information is available in the hfinger_analyze function

docstring. Fingerprint creation A fingerprint is based on features extracted from a request. Usage of particular features from the full list (https://github.com/CERT-Polska/docs/feature_description.md) depends on the chosen report mode from a predefined list (more information on report modes is here (https://github.com/CERT-Polska/hfinger#report-modes)). The figure below represents the creation of an exemplary fingerprint in the default report mode.