P4 bug’s and their POC steps | Part 1
Hi everyone, I am Nikhil aka socalledhacker, i am a security researcher , penetration tester, certified ethical hacker and a web3 noob. In…Continue reading on Medium »
Read more...
Hi everyone, I am Nikhil aka socalledhacker, i am a security researcher , penetration tester, certified ethical hacker and a web3 noob. In…Continue reading on Medium »
Read more...
Medium
P4 bug’s and their POC steps | Part 1
Hi everyone, I am Nikhil aka socalledhacker, i am a security researcher , penetration tester, certified ethical hacker and a web3 noob. In…
Introducing CorScan: A Comprehensive Tool for CORS Vulnerability Detection
Cross-Origin Resource Sharing (CORS) :Continue reading on Medium »
Read more...
Cross-Origin Resource Sharing (CORS) :Continue reading on Medium »
Read more...
Medium
Introducing CorScan: A Comprehensive Tool for CORS Vulnerability Detection
Cross-Origin Resource Sharing (CORS) :
How HTTP Request Smuggling Vulnerability Gets You a $750 Bug Bounty
Bug Bounty Reports Explained by Karthikeyan NagarajContinue reading on Medium »
Read more...
Bug Bounty Reports Explained by Karthikeyan NagarajContinue reading on Medium »
Read more...
Medium
How HTTP Request Smuggling Vulnerability Gets You a $750 Bug Bounty
Bug Bounty Reports Explained by Karthikeyan Nagaraj
Introducing CorScan: A Comprehensive Tool for CORS Vulnerability Detection
https://angixblack.medium.com/introducing-corscan-a-comprehensive-tool-for-cors-vulnerability-detection-4ce83be6870e?source=rss------bug_bounty-5
https://angixblack.medium.com/introducing-corscan-a-comprehensive-tool-for-cors-vulnerability-detection-4ce83be6870e?source=rss------bug_bounty-5
Cross-Origin Resource Sharing (CORS) :Continue reading on Medium » (https://angixblack.medium.com/introducing-corscan-a-comprehensive-tool-for-cors-vulnerability-detection-4ce83be6870e?source=rss------bug_bounty-5)
How HTTP Request Smuggling Vulnerability Gets You a $750 Bug Bounty
https://cyberw1ng.medium.com/how-http-request-smuggling-vulnerability-gets-you-a-750-bug-bounty-3dfe9063fd8d?source=rss------bug_bounty-5
https://cyberw1ng.medium.com/how-http-request-smuggling-vulnerability-gets-you-a-750-bug-bounty-3dfe9063fd8d?source=rss------bug_bounty-5
Bug Bounty Reports Explained by Karthikeyan NagarajContinue reading on Medium » (https://cyberw1ng.medium.com/how-http-request-smuggling-vulnerability-gets-you-a-750-bug-bounty-3dfe9063fd8d?source=rss------bug_bounty-5)
If you're a beginner or thinking about getting into pentesting, I have some tips for you
https://www.reddit.com/r/Pentesting/comments/1fcyqzr/if_youre_a_beginner_or_thinking_about_getting/
<!-- SC_OFF -->I've recently started to write a few articles on my spare time, and was thinking it could help out some people here as well. Sorry for using a new account, I want to keep this persona separated from my real name and everyday consultant job. I know that for me it seemed close to impossible to break into this field when starting out. I have my own way that I recommend people to do this, where the goal is to quickly land an entry-level job by learning the "must haves", and then get paid while learning the "nice to haves". I think way too many guides and roadmaps tell you to learn coding, take certifications and so on. Focus on practical experience, and leverage your soft skills like communication and problem-solving, these are critical in interviews and actual real-world pentests. Here are the 8 steps from my article that I think will fast-track you to a job in the field: Dedicate Yourself to the Journey: Pentesting is hard to learn, but not really any harder than learning any other fields. Commit fully to learning and improving. Persistence is key, especially when learning a field as focused on problem-solving as pentesting is. Understand the Goal of Penetration Testing: A penetration tester is NOT a hacker. Learn the difference, and focus a good amount of your time to learn that difference. In my opinion these are the weakpoints of many pentesters. Choose a Specialization: Even as a beginner I think this is important. Picking a in-demand specialization will make it much easier to become valuable in a team. Web, Cloud, OT are examples of this. Look around for job postings and such in your area. Get Hands-On Experience Real-world experience is essential. I know bug bounty programs are scary, but just throw that fear away and get at it. If you have bug bounty experience, I would value this as much, or maybe even more, than work experience. Choose the Right Certifications (if any): Yes, OSCP is great, but it teaches you general pentest knowledge only. Yes, SANS 560 is great, but it is way too expensive. Start with affordable, respected certifications in your niche. I would recommend certs like Burp Practitioner and CARTP. The expensive ones are for your future employers to pay. Develop Crucial Soft Skills: Communication is key. Your ability to present findings and write clear reports can absolutely be more important than the technical skills. This is highly undervalued by pentesters, and a great way to stand out from your competition. Overprepare for Interviews: People show up underprepared for interviews. Study the common interview methods. Talking through a pentest, live demos, talking about specific tools and so on. Prepare for the actual interviews, not just your pentest skills. Start Applying (Broadly) You need experience from job interviews. If your dream job is the first interview you show up to, you will most likely fail. You will be much better equipped to do well on your 10th interview than your 1st. But focus on what went wrong and improving from interview to interview, or you will be one of the people demonstrating the definition of insanity by saying "I showed up to 5000 interviews and didn't get a single job" If this seems interesting to you, here is a Friend Link to the full Medium article, so no paywall:
https://medium.com/top-cybersecurity-insights/the-2024-pentesting-roadmap-from-beginner-to-hired-in-8-steps-eb3c24f67a45?sk=11ab96a78b079f8a964fb72fb49f0f37 Good luck on becoming a penetration tester! <!-- SC_ON --> submitted by /u/vidar-frostbjorn (https://www.reddit.com/user/vidar-frostbjorn)
https://www.reddit.com/r/Pentesting/comments/1fcyqzr/if_youre_a_beginner_or_thinking_about_getting/
<!-- SC_OFF -->I've recently started to write a few articles on my spare time, and was thinking it could help out some people here as well. Sorry for using a new account, I want to keep this persona separated from my real name and everyday consultant job. I know that for me it seemed close to impossible to break into this field when starting out. I have my own way that I recommend people to do this, where the goal is to quickly land an entry-level job by learning the "must haves", and then get paid while learning the "nice to haves". I think way too many guides and roadmaps tell you to learn coding, take certifications and so on. Focus on practical experience, and leverage your soft skills like communication and problem-solving, these are critical in interviews and actual real-world pentests. Here are the 8 steps from my article that I think will fast-track you to a job in the field: Dedicate Yourself to the Journey: Pentesting is hard to learn, but not really any harder than learning any other fields. Commit fully to learning and improving. Persistence is key, especially when learning a field as focused on problem-solving as pentesting is. Understand the Goal of Penetration Testing: A penetration tester is NOT a hacker. Learn the difference, and focus a good amount of your time to learn that difference. In my opinion these are the weakpoints of many pentesters. Choose a Specialization: Even as a beginner I think this is important. Picking a in-demand specialization will make it much easier to become valuable in a team. Web, Cloud, OT are examples of this. Look around for job postings and such in your area. Get Hands-On Experience Real-world experience is essential. I know bug bounty programs are scary, but just throw that fear away and get at it. If you have bug bounty experience, I would value this as much, or maybe even more, than work experience. Choose the Right Certifications (if any): Yes, OSCP is great, but it teaches you general pentest knowledge only. Yes, SANS 560 is great, but it is way too expensive. Start with affordable, respected certifications in your niche. I would recommend certs like Burp Practitioner and CARTP. The expensive ones are for your future employers to pay. Develop Crucial Soft Skills: Communication is key. Your ability to present findings and write clear reports can absolutely be more important than the technical skills. This is highly undervalued by pentesters, and a great way to stand out from your competition. Overprepare for Interviews: People show up underprepared for interviews. Study the common interview methods. Talking through a pentest, live demos, talking about specific tools and so on. Prepare for the actual interviews, not just your pentest skills. Start Applying (Broadly) You need experience from job interviews. If your dream job is the first interview you show up to, you will most likely fail. You will be much better equipped to do well on your 10th interview than your 1st. But focus on what went wrong and improving from interview to interview, or you will be one of the people demonstrating the definition of insanity by saying "I showed up to 5000 interviews and didn't get a single job" If this seems interesting to you, here is a Friend Link to the full Medium article, so no paywall:
https://medium.com/top-cybersecurity-insights/the-2024-pentesting-roadmap-from-beginner-to-hired-in-8-steps-eb3c24f67a45?sk=11ab96a78b079f8a964fb72fb49f0f37 Good luck on becoming a penetration tester! <!-- SC_ON --> submitted by /u/vidar-frostbjorn (https://www.reddit.com/user/vidar-frostbjorn)
What Pen Test Vendors do you use or Recommend?
https://www.reddit.com/r/Pentesting/comments/1fd046r/what_pen_test_vendors_do_you_use_or_recommend/
<!-- SC_OFF -->I'm looking to see what you guys use or recommend for vendors. I'm working on reaching out to vendors but I wanted to get your guy's take. This is what my environment has. 3 web applications Internal Network testing The previous vendor was roughly $30K annually. <!-- SC_ON --> submitted by /u/IT-Jedi (https://www.reddit.com/user/IT-Jedi)
[link] (https://www.reddit.com/r/Pentesting/comments/1fd046r/what_pen_test_vendors_do_you_use_or_recommend/) [comments] (https://www.reddit.com/r/Pentesting/comments/1fd046r/what_pen_test_vendors_do_you_use_or_recommend/)
https://www.reddit.com/r/Pentesting/comments/1fd046r/what_pen_test_vendors_do_you_use_or_recommend/
<!-- SC_OFF -->I'm looking to see what you guys use or recommend for vendors. I'm working on reaching out to vendors but I wanted to get your guy's take. This is what my environment has. 3 web applications Internal Network testing The previous vendor was roughly $30K annually. <!-- SC_ON --> submitted by /u/IT-Jedi (https://www.reddit.com/user/IT-Jedi)
[link] (https://www.reddit.com/r/Pentesting/comments/1fd046r/what_pen_test_vendors_do_you_use_or_recommend/) [comments] (https://www.reddit.com/r/Pentesting/comments/1fd046r/what_pen_test_vendors_do_you_use_or_recommend/)
Spoofed Number Called
https://www.reddit.com/r/Pentesting/comments/1fd1xqh/spoofed_number_called/
<!-- SC_OFF -->I received a spoofed number that was my banks number. Can I trace this to the original number? <!-- SC_ON --> submitted by /u/weedsgoodd (https://www.reddit.com/user/weedsgoodd)
[link] (https://www.reddit.com/r/Pentesting/comments/1fd1xqh/spoofed_number_called/) [comments] (https://www.reddit.com/r/Pentesting/comments/1fd1xqh/spoofed_number_called/)
https://www.reddit.com/r/Pentesting/comments/1fd1xqh/spoofed_number_called/
<!-- SC_OFF -->I received a spoofed number that was my banks number. Can I trace this to the original number? <!-- SC_ON --> submitted by /u/weedsgoodd (https://www.reddit.com/user/weedsgoodd)
[link] (https://www.reddit.com/r/Pentesting/comments/1fd1xqh/spoofed_number_called/) [comments] (https://www.reddit.com/r/Pentesting/comments/1fd1xqh/spoofed_number_called/)
Securing Your Applications Against CSRF Attacks: Best Practices for Cybersecurity Experts
What is CSRF?Continue reading on Medium »
Read more...
What is CSRF?Continue reading on Medium »
Read more...
Medium
Securing Your Applications Against CSRF Attacks: Best Practices for Cybersecurity Experts
What is CSRF?
Securing Your Applications Against CSRF Attacks: Best Practices for Cybersecurity Experts
https://medium.com/@kpishear/securing-your-applications-against-csrf-attacks-best-practices-for-cybersecurity-experts-4e572b9fc032?source=rss------bug_bounty-5
https://medium.com/@kpishear/securing-your-applications-against-csrf-attacks-best-practices-for-cybersecurity-experts-4e572b9fc032?source=rss------bug_bounty-5
What is CSRF?Continue reading on Medium » (https://medium.com/@kpishear/securing-your-applications-against-csrf-attacks-best-practices-for-cybersecurity-experts-4e572b9fc032?source=rss------bug_bounty-5)
My first Hall of Fame (HoF) | Bug Bounty Journey.
How you can get yours too.Continue reading on Medium »
Read more...
How you can get yours too.Continue reading on Medium »
Read more...
Medium
My first Hall of Fame (HoF) | Bug Bounty Journey.
How you can get yours too.
Insider Secrets to Earning $100 to $250 in Bug Bounties
Methodology:Continue reading on Medium »
Read more...
Methodology:Continue reading on Medium »
Read more...
Medium
Insider Secrets to Earning $100 to $250 in Bug Bounties
Methodology:
Advanced Web Application Security Checklist
1. Authentication and Session ManagementContinue reading on InfoSec Write-ups »
Read more...
1. Authentication and Session ManagementContinue reading on InfoSec Write-ups »
Read more...
Medium
Advanced Web Application Security Checklist
1. Authentication and Session Management
A Story About How i Found CVE-2020–27838 in TVH responsible disclosure
A Story About CVE-2020–27838 in TVH responsible disclosure A few months ago, during a security assessment of a client’s system, I stumbled upon a critical flaw in the TVH authentication server that could expose sensitive information. This vulnerability, identified as CVE-2020–27838, allows unauthorized access to client registration details in Keycloak, potentially compromising the confidentiality of sensitive data. Here’s how I discovered and explored this vulnerability.The Discovery While testing the TVH authentication server, I identified a vulnerability in the Keycloak client registration endpoint that allowed information exposure without proper authentication. Specifically, I found that the endpoint at https://xxxxxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console was leaking sensitive details.Understanding the VulnerabilityBug Name: Information ExposureBug Priority: MediumVulnerable URL: https://xxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console CVE Description: This vulnerability was found in Keycloak versions prior to 13.0.0. The issue lies in the client registration endpoint, which allows fetching information about PUBLIC clients, including the client secret, without requiring authentication. This becomes particularly dangerous if a PUBLIC client is later switched to CONFIDENTIAL status, as the previously exposed secrets could still be accessed without proper authorization. The highest risk from this flaw is the potential compromise of data confidentiality.Impact The vulnerability allows an attacker to gain sensitive information from the Keycloak server, which could be exploited to access or manipulate client data. This could lead to unauthorized access to confidential information, potentially compromising the integrity of the affected system.Automating the Hunt To streamline the process of identifying this vulnerability, I developed a Python tool that automates the testing of the vulnerable endpoint. You can easily install and use this tool as follows: ToolPOC: CVE-2020–27838 on githubpip install CVE-2020-27838 CVE-2020-27838 --chatid <YourTelegramChatID>To Check a Single URL:CVE-2020-27838 -u http://mytargetprogram.comTo Check a List of URLs:CVE-2020-27838 -i urls.txtProof of Concept (POC) To demonstrate the vulnerability, the tool automates the process of testing the endpoint for information exposure. Here’s a sample POC image:POC ImageRemediation To mitigate this vulnerability, it is essential to apply the latest security patches or updates provided by the Keycloak vendor. Updating to a version later than 13.0.0 will resolve this issue by requiring proper authentication before accessing sensitive client information. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you’re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com. For enrolling my cybersecurity and Bugbounty course, WhatsApp +91 82709 13635.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V A Story About How i Found CVE-2020–27838 in TVH responsible disclosure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
A Story About CVE-2020–27838 in TVH responsible disclosure A few months ago, during a security assessment of a client’s system, I stumbled upon a critical flaw in the TVH authentication server that could expose sensitive information. This vulnerability, identified as CVE-2020–27838, allows unauthorized access to client registration details in Keycloak, potentially compromising the confidentiality of sensitive data. Here’s how I discovered and explored this vulnerability.The Discovery While testing the TVH authentication server, I identified a vulnerability in the Keycloak client registration endpoint that allowed information exposure without proper authentication. Specifically, I found that the endpoint at https://xxxxxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console was leaking sensitive details.Understanding the VulnerabilityBug Name: Information ExposureBug Priority: MediumVulnerable URL: https://xxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console CVE Description: This vulnerability was found in Keycloak versions prior to 13.0.0. The issue lies in the client registration endpoint, which allows fetching information about PUBLIC clients, including the client secret, without requiring authentication. This becomes particularly dangerous if a PUBLIC client is later switched to CONFIDENTIAL status, as the previously exposed secrets could still be accessed without proper authorization. The highest risk from this flaw is the potential compromise of data confidentiality.Impact The vulnerability allows an attacker to gain sensitive information from the Keycloak server, which could be exploited to access or manipulate client data. This could lead to unauthorized access to confidential information, potentially compromising the integrity of the affected system.Automating the Hunt To streamline the process of identifying this vulnerability, I developed a Python tool that automates the testing of the vulnerable endpoint. You can easily install and use this tool as follows: ToolPOC: CVE-2020–27838 on githubpip install CVE-2020-27838 CVE-2020-27838 --chatid <YourTelegramChatID>To Check a Single URL:CVE-2020-27838 -u http://mytargetprogram.comTo Check a List of URLs:CVE-2020-27838 -i urls.txtProof of Concept (POC) To demonstrate the vulnerability, the tool automates the process of testing the endpoint for information exposure. Here’s a sample POC image:POC ImageRemediation To mitigate this vulnerability, it is essential to apply the latest security patches or updates provided by the Keycloak vendor. Updating to a version later than 13.0.0 will resolve this issue by requiring proper authentication before accessing sensitive client information. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you’re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com. For enrolling my cybersecurity and Bugbounty course, WhatsApp +91 82709 13635.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V A Story About How i Found CVE-2020–27838 in TVH responsible disclosure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...