BountyDork: Your Ultimate Automatic Dorking Testing Companion For Bug Bounty

Discover BountyDork, a powerful tool designed for penetration testers and cybersecurity researchers, offering automation, reporting, and…Continue reading on InfoSec Write-ups »
Read more...

A Simple 2FA Bypass

2FA bypass through response manipulation Two-Factor Authentication (2FA) serves as a robust shield against unauthorized access. However, during a recent engagement in a RVDP, I found a critical vulnerability that allows an attacker to bypass 2FA using response manipulation.Bug-bounty (zoom.us) Below are the steps that led to bypass 2FA:I logged-in as a normal user and enabled 2FA for that accountNext, I logged out and logged-in again with login credentialsThen I entered the wrong OTP and captured that response to that request as shown belowWrong OTP Response 4. The response had 401 Unauthorized and the body had wrong OTP message 5. I manipulated the response code to 200 OK and replaced the body with the content of valid OTPManipulated Response 6. That’s it, with this I was able to bypass the 2FA of that account. And to confirm if it has really bypassed the 2FA, after logging in I disabled the 2FA, logged out and then logged in again and this time it didn’t asked for a 2FA code to be entered. hackerdevil Stay safe, stay informed, and keep coming back for more empowering insights. Thank You for reading. Knowledge is power, so keep gaining!! A Simple 2FA Bypass was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

IDOR in Multinational Retail Company Leading to Unauthorized Access and Modifications

In this post, we will discuss a high severity vulnerability I identified in a company’s web application, which allows users to exploit an…Continue reading on Medium »
Read more...

IDOR in Multinational Retail Company Leading to Unauthorized Access and Modifications
https://medium.com/@kamalinux/idor-in-multinational-retail-company-leading-to-unauthorized-access-and-modifications-e36f8ea9e859?source=rss------bug_bounty-5

In this post, we will discuss a high severity vulnerability I identified in a company’s web application, which allows users to exploit an…Continue reading on Medium » (https://medium.com/@kamalinux/idor-in-multinational-retail-company-leading-to-unauthorized-access-and-modifications-e36f8ea9e859?source=rss------bug_bounty-5)

Disguising Malicious Files to Look Like Normal EXE or PDFs

Disclaimer: Creating and distributing malicious software is illegal and unethical. This article is for educational purposes only. Always…Continue reading on OSINT TEAM »
Read more...

Find XSS on the Fly ( Full guide )

Discover my comprehensive guide on identifying all types of XSS vulnerabilities, including stored, reflected, and DOM-based XSS.Continue reading on Medium »
Read more...

Disguising Malicious Files to Look Like Normal EXE or PDFs
https://osintteam.blog/disguising-malicious-files-to-look-like-normal-exe-or-pdfs-d785e116e989?source=rss------bug_bounty-5

Disclaimer: Creating and distributing malicious software is illegal and unethical. This article is for educational purposes only. Always…Continue reading on OSINT TEAM » (https://osintteam.blog/disguising-malicious-files-to-look-like-normal-exe-or-pdfs-d785e116e989?source=rss------bug_bounty-5)

Find XSS on the Fly ( Full guide )
https://medium.com/@zack0x01_/find-xss-on-the-fly-full-guide-300f07fb86ae?source=rss------bug_bounty-5

Discover my comprehensive guide on identifying all types of XSS vulnerabilities, including stored, reflected, and DOM-based XSS.Continue reading on Medium » (https://medium.com/@zack0x01_/find-xss-on-the-fly-full-guide-300f07fb86ae?source=rss------bug_bounty-5)

CVE-2024–34750 Apache Tomcat DoS vulnerability in HTTP/2 connector

Learn More About Cyber Security , Hacking And Get Your First Certificate For Free On …Continue reading on Medium »
Read more...

Escalating XSS in PhantomJS Image Rendering to SSRF/Local-File Read

Learn More About Cyber Security , Hacking And Get Your First Certificate For Free On …Continue reading on Medium »
Read more...

Detecting and exploiting limit overrun race conditions with Burp Repeater

The process of detecting and exploiting limit overrun race conditions is relatively simple. In high-level terms, all you need to do is…Continue reading on Medium »
Read more...

HackerOne 2FA Bypass Vulnerability Exposed!

A threat actor has claimed a shocking vulnerability in the HackerOne Bug Bounty Platform that allows 2FA to be bypassed!Continue reading on Medium »
Read more...

CVE-2024–34750 Apache Tomcat DoS vulnerability in HTTP/2 connector
https://medium.com/@proseizala/cve-2024-34750-apache-tomcat-dos-vulnerability-in-http-2-connector-54033187cd4b?source=rss------bug_bounty-5

Learn More About Cyber Security , Hacking And Get Your First Certificate For Free On …Continue reading on Medium » (https://medium.com/@proseizala/cve-2024-34750-apache-tomcat-dos-vulnerability-in-http-2-connector-54033187cd4b?source=rss------bug_bounty-5)