Zero to OSWE: Navigating the Journey with HTB
https://adipsharif.medium.com/zero-to-oswe-navigating-the-journey-with-htb-b1972b99a646?source=rss------bug_bounty-5
https://adipsharif.medium.com/zero-to-oswe-navigating-the-journey-with-htb-b1972b99a646?source=rss------bug_bounty-5
Hello everyone i’m back again with another guide, today i will show the path from achieving OSWA to OSWE (Advanced Web Application…Continue reading on Medium » (https://adipsharif.medium.com/zero-to-oswe-navigating-the-journey-with-htb-b1972b99a646?source=rss------bug_bounty-5)
Common 403 Bypasses Part 1
Are you tired of seeing those 403 Forbidden errors that block you while testing? Don’t worry, some effective techniques could help to avoid this hassle! Let’s explore some 403 Bypasses that work!https://medium.com/media/c348438344eb936f5e68c114775d6393/hrefWhat is the 403 Status Code? This status code limits users’ access to specific hosts, endpoints, etc. It could be implemented either in the web application code, or there could be certain Web Application Firewall rules. There might be different cases for bypasses because of different sets of technologies. So it does mean that there won’t be an all-in-one solution for most cases, but we will still explore the most common ways! There are multiple techniques that we will try to cover in this writeup:Applying special characters to the URLSwitching HTTP MethodsHeaders manipulationSwitching IP or using a VPN providerFuzzing HTTP Methods Let’s start with the method which is pretty easy to check. If you get 403 status just by trying to access a certain endpoint, while on other endpoints you are getting 200, this could be one of the first things to try. The idea is to check the web application’s handling of different HTTP methods (like GET, POST, PUT, DELETE, etc.), to see if changing them can lead to other status codes like 200. It is just as simple as that, to quickly check this, you could use an HTTP proxy like burp: or you could send the request with CLI tools like curl:Headers Manipulation Another technique could be used when you get a 403 code when trying to access a website for the first time. I do recommend trying to play around with those headers: Together with them, you could use 127.0.0.1, localhost or even some cloud internal IPs could work as well: Some Burp Suite plugins do that, or you could inject just another header like this inside the request. I also use this with CLI tools as an extra header, for example, when using httpx at the mass scale:Changing IP Address or Using a VPN You could also get blocked by a Web Application Firewall by doing malicious actions. For example, if you send too many requests containing known malicious payloads, using too many requests per second, trying to access known sensitive files, your IP might get blacklisted. Your IP could get blacklisted for a certain amount of time, or even indefinitely! For this reason, I do recommend having either an IP proxy, which could take more effort, or just using a VPN provider. I do use NordVPN, not for those reasons to access certain content, but mainly when I get blocked while testing! I do save a lot of time and nerves when using this product since others could be slow or not really reliable.Fuzzing the URL Path And the last one — is using some tricks to the URL path. I have had the most success with this one. Either if you having issues accessing the website for the first time, or a certain endpoint is not reachable, it is worth trying to send these payloads: I have discovered some swagger documentation sites using this method, which eventually led me to discover a more severe bug — SQL injection.Summary As the introduction of 403 bypasses, we’ve covered some ways to tackle 403 Forbidden errors, from simple URL changes to sophisticated header manipulations. In the second part, we will dive into more techniques and I will also show you some of my favorite command line utilities to automate detection! It was my pleasure sharing this knowledge, wish you a nice hunt! If you find this information useful, please share this article on your social media, I will greatly appreciate it! I am active on Twitter, check out some content I post there daily! If you are interested in video content, check my YouTube. Also, if you want to reach me personally, you can visit my Discord server. Cheers! Originally published at https://ott3rly.com on July 1, 2024. Common 403 Bypasses Part 1 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Are you tired of seeing those 403 Forbidden errors that block you while testing? Don’t worry, some effective techniques could help to avoid this hassle! Let’s explore some 403 Bypasses that work!https://medium.com/media/c348438344eb936f5e68c114775d6393/hrefWhat is the 403 Status Code? This status code limits users’ access to specific hosts, endpoints, etc. It could be implemented either in the web application code, or there could be certain Web Application Firewall rules. There might be different cases for bypasses because of different sets of technologies. So it does mean that there won’t be an all-in-one solution for most cases, but we will still explore the most common ways! There are multiple techniques that we will try to cover in this writeup:Applying special characters to the URLSwitching HTTP MethodsHeaders manipulationSwitching IP or using a VPN providerFuzzing HTTP Methods Let’s start with the method which is pretty easy to check. If you get 403 status just by trying to access a certain endpoint, while on other endpoints you are getting 200, this could be one of the first things to try. The idea is to check the web application’s handling of different HTTP methods (like GET, POST, PUT, DELETE, etc.), to see if changing them can lead to other status codes like 200. It is just as simple as that, to quickly check this, you could use an HTTP proxy like burp: or you could send the request with CLI tools like curl:Headers Manipulation Another technique could be used when you get a 403 code when trying to access a website for the first time. I do recommend trying to play around with those headers: Together with them, you could use 127.0.0.1, localhost or even some cloud internal IPs could work as well: Some Burp Suite plugins do that, or you could inject just another header like this inside the request. I also use this with CLI tools as an extra header, for example, when using httpx at the mass scale:Changing IP Address or Using a VPN You could also get blocked by a Web Application Firewall by doing malicious actions. For example, if you send too many requests containing known malicious payloads, using too many requests per second, trying to access known sensitive files, your IP might get blacklisted. Your IP could get blacklisted for a certain amount of time, or even indefinitely! For this reason, I do recommend having either an IP proxy, which could take more effort, or just using a VPN provider. I do use NordVPN, not for those reasons to access certain content, but mainly when I get blocked while testing! I do save a lot of time and nerves when using this product since others could be slow or not really reliable.Fuzzing the URL Path And the last one — is using some tricks to the URL path. I have had the most success with this one. Either if you having issues accessing the website for the first time, or a certain endpoint is not reachable, it is worth trying to send these payloads: I have discovered some swagger documentation sites using this method, which eventually led me to discover a more severe bug — SQL injection.Summary As the introduction of 403 bypasses, we’ve covered some ways to tackle 403 Forbidden errors, from simple URL changes to sophisticated header manipulations. In the second part, we will dive into more techniques and I will also show you some of my favorite command line utilities to automate detection! It was my pleasure sharing this knowledge, wish you a nice hunt! If you find this information useful, please share this article on your social media, I will greatly appreciate it! I am active on Twitter, check out some content I post there daily! If you are interested in video content, check my YouTube. Also, if you want to reach me personally, you can visit my Discord server. Cheers! Originally published at https://ott3rly.com on July 1, 2024. Common 403 Bypasses Part 1 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
How I found IDOR in NASA
Hello, everyone. In this write-up, I will explain how I found a simple IDOR bug.Photo by Nahel Abdul Hadi on Unsplash Summary: During my research, I discovered a security vulnerability known as an IDOR (Insecure Direct Object Reference) bug. This bug allows unauthorized users to access order information by manipulating order IDs within a system. While investigating IDOR vulnerabilities, I found that it was possible to access the details of any order made by any user by changing the order ID. Exploiting this flaw could allow an attacker to circumvent access controls and obtain order information.https://medium.com/media/af667412ec7c885f0bf4744b45e72a08/href Impact:Unauthorized Access to Order Information: By manipulating order IDs, attackers can gain access to order information associated with orders, such as order details, etc. I hope my write-up is helpful for you. If you notice any errors, please let me know to correct them. Thank you for reading. How I found IDOR in NASA was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Hello, everyone. In this write-up, I will explain how I found a simple IDOR bug.Photo by Nahel Abdul Hadi on Unsplash Summary: During my research, I discovered a security vulnerability known as an IDOR (Insecure Direct Object Reference) bug. This bug allows unauthorized users to access order information by manipulating order IDs within a system. While investigating IDOR vulnerabilities, I found that it was possible to access the details of any order made by any user by changing the order ID. Exploiting this flaw could allow an attacker to circumvent access controls and obtain order information.https://medium.com/media/af667412ec7c885f0bf4744b45e72a08/href Impact:Unauthorized Access to Order Information: By manipulating order IDs, attackers can gain access to order information associated with orders, such as order details, etc. I hope my write-up is helpful for you. If you notice any errors, please let me know to correct them. Thank you for reading. How I found IDOR in NASA was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
YouTube
IDOR In NASA
BountyDork: Your Ultimate Automatic Dorking Testing Companion For Bug Bounty
Discover BountyDork, a powerful tool designed for penetration testers and cybersecurity researchers, offering automation, reporting, and…Continue reading on InfoSec Write-ups »
Read more...
Discover BountyDork, a powerful tool designed for penetration testers and cybersecurity researchers, offering automation, reporting, and…Continue reading on InfoSec Write-ups »
Read more...
Medium
BountyDork: Your Ultimate Automatic Dorking Testing Companion For Bug Bounty
Discover BountyDork, a powerful tool designed for penetration testers and cybersecurity researchers, offering automation, reporting, and…
A Simple 2FA Bypass
2FA bypass through response manipulation Two-Factor Authentication (2FA) serves as a robust shield against unauthorized access. However, during a recent engagement in a RVDP, I found a critical vulnerability that allows an attacker to bypass 2FA using response manipulation.Bug-bounty (zoom.us) Below are the steps that led to bypass 2FA:I logged-in as a normal user and enabled 2FA for that accountNext, I logged out and logged-in again with login credentialsThen I entered the wrong OTP and captured that response to that request as shown belowWrong OTP Response 4. The response had 401 Unauthorized and the body had wrong OTP message 5. I manipulated the response code to 200 OK and replaced the body with the content of valid OTPManipulated Response 6. That’s it, with this I was able to bypass the 2FA of that account. And to confirm if it has really bypassed the 2FA, after logging in I disabled the 2FA, logged out and then logged in again and this time it didn’t asked for a 2FA code to be entered. hackerdevil Stay safe, stay informed, and keep coming back for more empowering insights. Thank You for reading. Knowledge is power, so keep gaining!! A Simple 2FA Bypass was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
2FA bypass through response manipulation Two-Factor Authentication (2FA) serves as a robust shield against unauthorized access. However, during a recent engagement in a RVDP, I found a critical vulnerability that allows an attacker to bypass 2FA using response manipulation.Bug-bounty (zoom.us) Below are the steps that led to bypass 2FA:I logged-in as a normal user and enabled 2FA for that accountNext, I logged out and logged-in again with login credentialsThen I entered the wrong OTP and captured that response to that request as shown belowWrong OTP Response 4. The response had 401 Unauthorized and the body had wrong OTP message 5. I manipulated the response code to 200 OK and replaced the body with the content of valid OTPManipulated Response 6. That’s it, with this I was able to bypass the 2FA of that account. And to confirm if it has really bypassed the 2FA, after logging in I disabled the 2FA, logged out and then logged in again and this time it didn’t asked for a 2FA code to be entered. hackerdevil Stay safe, stay informed, and keep coming back for more empowering insights. Thank You for reading. Knowledge is power, so keep gaining!! A Simple 2FA Bypass was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
A Simple 2FA Bypass
2FA bypass through response manipulation
IDOR in Multinational Retail Company Leading to Unauthorized Access and Modifications
In this post, we will discuss a high severity vulnerability I identified in a company’s web application, which allows users to exploit an…Continue reading on Medium »
Read more...
In this post, we will discuss a high severity vulnerability I identified in a company’s web application, which allows users to exploit an…Continue reading on Medium »
Read more...
Medium
IDOR in Multinational Retail Company Leading to Unauthorized Access and Modifications
In this write-up, we will discuss a high vulnerability I identified in a multinational retail company’s web application, which allows users…
IDOR in Multinational Retail Company Leading to Unauthorized Access and Modifications
https://medium.com/@kamalinux/idor-in-multinational-retail-company-leading-to-unauthorized-access-and-modifications-e36f8ea9e859?source=rss------bug_bounty-5
https://medium.com/@kamalinux/idor-in-multinational-retail-company-leading-to-unauthorized-access-and-modifications-e36f8ea9e859?source=rss------bug_bounty-5
In this post, we will discuss a high severity vulnerability I identified in a company’s web application, which allows users to exploit an…Continue reading on Medium » (https://medium.com/@kamalinux/idor-in-multinational-retail-company-leading-to-unauthorized-access-and-modifications-e36f8ea9e859?source=rss------bug_bounty-5)
Disguising Malicious Files to Look Like Normal EXE or PDFs
Disclaimer: Creating and distributing malicious software is illegal and unethical. This article is for educational purposes only. Always…Continue reading on OSINT TEAM »
Read more...
Disclaimer: Creating and distributing malicious software is illegal and unethical. This article is for educational purposes only. Always…Continue reading on OSINT TEAM »
Read more...
Medium
Disguising Malicious Files to Look Like Normal EXE or PDFs
Disclaimer: Creating and distributing malicious software is illegal and unethical. This article is for educational purposes only. Always…
Find XSS on the Fly ( Full guide )
Discover my comprehensive guide on identifying all types of XSS vulnerabilities, including stored, reflected, and DOM-based XSS.Continue reading on Medium »
Read more...
Discover my comprehensive guide on identifying all types of XSS vulnerabilities, including stored, reflected, and DOM-based XSS.Continue reading on Medium »
Read more...
Medium
Find XSS on the Fly 🔥( Full guide )
Discover my comprehensive guide on identifying all types of XSS vulnerabilities, including stored, reflected, and DOM-based XSS.
Disguising Malicious Files to Look Like Normal EXE or PDFs
https://osintteam.blog/disguising-malicious-files-to-look-like-normal-exe-or-pdfs-d785e116e989?source=rss------bug_bounty-5
https://osintteam.blog/disguising-malicious-files-to-look-like-normal-exe-or-pdfs-d785e116e989?source=rss------bug_bounty-5
Disclaimer: Creating and distributing malicious software is illegal and unethical. This article is for educational purposes only. Always…Continue reading on OSINT TEAM » (https://osintteam.blog/disguising-malicious-files-to-look-like-normal-exe-or-pdfs-d785e116e989?source=rss------bug_bounty-5)
Find XSS on the Fly ( Full guide )
https://medium.com/@zack0x01_/find-xss-on-the-fly-full-guide-300f07fb86ae?source=rss------bug_bounty-5
https://medium.com/@zack0x01_/find-xss-on-the-fly-full-guide-300f07fb86ae?source=rss------bug_bounty-5
Discover my comprehensive guide on identifying all types of XSS vulnerabilities, including stored, reflected, and DOM-based XSS.Continue reading on Medium » (https://medium.com/@zack0x01_/find-xss-on-the-fly-full-guide-300f07fb86ae?source=rss------bug_bounty-5)
CVE-2024–34750 Apache Tomcat DoS vulnerability in HTTP/2 connector
Learn More About Cyber Security , Hacking And Get Your First Certificate For Free On …Continue reading on Medium »
Read more...
Learn More About Cyber Security , Hacking And Get Your First Certificate For Free On …Continue reading on Medium »
Read more...
Escalating XSS in PhantomJS Image Rendering to SSRF/Local-File Read
Learn More About Cyber Security , Hacking And Get Your First Certificate For Free On …Continue reading on Medium »
Read more...
Learn More About Cyber Security , Hacking And Get Your First Certificate For Free On …Continue reading on Medium »
Read more...