submitted by /u/SkyFallRobin (https://www.reddit.com/user/SkyFallRobin)
[link] (https://github.com/RootUp/SmuggleShield) [comments] (https://www.reddit.com/r/Pentesting/comments/1hrvd7r/github_rootupsmuggleshield_protection_against/)
[link] (https://github.com/RootUp/SmuggleShield) [comments] (https://www.reddit.com/r/Pentesting/comments/1hrvd7r/github_rootupsmuggleshield_protection_against/)
Bypassing Email verification through HTTP response interception
In the Name of Allah, the Most Beneficent, the Most Merciful. All the praises and thanks be to Allah, the Lord of the ‘Alamin (mankind, jinns and all that exists). Hello Fellas :-), Alhamdulillah, it’s a new day. Today, I’d like to share a security issue I discovered on a self-hosted program related to email verification. Unfortunately, I never received a response about the report, nor did I follow up to check if the issue was fixed. Nonetheless, I believe it’s worth documenting for learning purposes.follow-up Let’s start.https://medium.com/media/e79202c3e17ffdadc61af5bc5886aa3c/hrefNote: I’ll be using gaza.com and palestine.com as placeholders for the actual hostnames.Summary While testing the signup process on gaza.com, I was directed to https://palestine.com/account/dashboard/?utm_source=gaza&utm_medium=banner&utm_campaign=valentine2024&utm_content=email&ref=2276&visit_id=1054793, I discovered that the email verification code is being sent back in the HTTP response after submitting the signup form. At first, I thought, “Is this real, or are you kidding me?” So, I checked my temporary email to confirm if the verification code in the HTTP response matched the one sent to the email and it did! This allows me to intercept the request and retrieve the verification code without needing to check the associated email account, potentially bypassing the verification step.Steps to Reproduce:Navigate to the signup page.Fill out the required fields (name, email, password, etc.).Intercept the request when clicking the “Signup” button using Burp Suite or any other HTTP proxy tool.Forward the intercepted request to the server.In the server’s response, observe that the verification code sent to the user’s email is included in the response. Observed Behavior: The server sends the verification code both to the user’s email and within the HTTP response body. This allows anyone with access to the HTTP response to retrieve the verification code and complete the signup process without checking their email. Expected Behavior: The verification code should only be sent to the email address provided during signup. It should not be disclosed in any HTTP responses or be accessible via the client-side application. Impact: This issue can allow an attacker to:Bypass email verification by capturing the verification code directly from the response.Automate account creation using fake or unverified email addresses.Additional Thought While writing this, I wondered: Could this vulnerability also allow account takeover via the “Forgot Password” functionality? If the forgot password verification code is also disclosed in the HTTP response, it might be possible to reset another user’s password without email access. What do you think? Should this be tested further?https://medium.com/media/2bcab1150f3bff5ce97741a5a706ec72/href I hope you learned something from this write-up! Thank you for reading till the end. If you found it helpful, please show your support by clapping for this write-up.For any suggestions or Correction, Kindly reach out to me:Twitter — callgh0stIsrael’s genocidal assault on Palestinians in Gaza has killed many tens of thousands of Palestinians and displaced over 90% of the entire population, most multiple times. Due to Israel’s blockade, and its targeting of life-sustaining infrastructure, Palestinians in Gaza are facing imminent famine.Israel can only carry out its devastating attacks on Palestinians because of the support provided by corporations and financial institutions. Bypassing Email verification through HTTP response interception was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
In the Name of Allah, the Most Beneficent, the Most Merciful. All the praises and thanks be to Allah, the Lord of the ‘Alamin (mankind, jinns and all that exists). Hello Fellas :-), Alhamdulillah, it’s a new day. Today, I’d like to share a security issue I discovered on a self-hosted program related to email verification. Unfortunately, I never received a response about the report, nor did I follow up to check if the issue was fixed. Nonetheless, I believe it’s worth documenting for learning purposes.follow-up Let’s start.https://medium.com/media/e79202c3e17ffdadc61af5bc5886aa3c/hrefNote: I’ll be using gaza.com and palestine.com as placeholders for the actual hostnames.Summary While testing the signup process on gaza.com, I was directed to https://palestine.com/account/dashboard/?utm_source=gaza&utm_medium=banner&utm_campaign=valentine2024&utm_content=email&ref=2276&visit_id=1054793, I discovered that the email verification code is being sent back in the HTTP response after submitting the signup form. At first, I thought, “Is this real, or are you kidding me?” So, I checked my temporary email to confirm if the verification code in the HTTP response matched the one sent to the email and it did! This allows me to intercept the request and retrieve the verification code without needing to check the associated email account, potentially bypassing the verification step.Steps to Reproduce:Navigate to the signup page.Fill out the required fields (name, email, password, etc.).Intercept the request when clicking the “Signup” button using Burp Suite or any other HTTP proxy tool.Forward the intercepted request to the server.In the server’s response, observe that the verification code sent to the user’s email is included in the response. Observed Behavior: The server sends the verification code both to the user’s email and within the HTTP response body. This allows anyone with access to the HTTP response to retrieve the verification code and complete the signup process without checking their email. Expected Behavior: The verification code should only be sent to the email address provided during signup. It should not be disclosed in any HTTP responses or be accessible via the client-side application. Impact: This issue can allow an attacker to:Bypass email verification by capturing the verification code directly from the response.Automate account creation using fake or unverified email addresses.Additional Thought While writing this, I wondered: Could this vulnerability also allow account takeover via the “Forgot Password” functionality? If the forgot password verification code is also disclosed in the HTTP response, it might be possible to reset another user’s password without email access. What do you think? Should this be tested further?https://medium.com/media/2bcab1150f3bff5ce97741a5a706ec72/href I hope you learned something from this write-up! Thank you for reading till the end. If you found it helpful, please show your support by clapping for this write-up.For any suggestions or Correction, Kindly reach out to me:Twitter — callgh0stIsrael’s genocidal assault on Palestinians in Gaza has killed many tens of thousands of Palestinians and displaced over 90% of the entire population, most multiple times. Due to Israel’s blockade, and its targeting of life-sustaining infrastructure, Palestinians in Gaza are facing imminent famine.Israel can only carry out its devastating attacks on Palestinians because of the support provided by corporations and financial institutions. Bypassing Email verification through HTTP response interception was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Three Russian-German Nationals Charged with Spying for Russia
https://medium.com/@wiretor/three-russian-german-nationals-charged-with-spying-for-russia-838f9b0d39d4?source=rss------bug_bounty-5
https://medium.com/@wiretor/three-russian-german-nationals-charged-with-spying-for-russia-838f9b0d39d4?source=rss------bug_bounty-5
WIRE TOR — The Ethical Hacking ServicesContinue reading on Medium » (https://medium.com/@wiretor/three-russian-german-nationals-charged-with-spying-for-russia-838f9b0d39d4?source=rss------bug_bounty-5)
Election Interference Exposed: Iranian and Russian Cyber Tactics in the Spotlight
https://medium.com/@wiretor/election-interference-exposed-iranian-and-russian-cyber-tactics-in-the-spotlight-3e9059006021?source=rss------bug_bounty-5
https://medium.com/@wiretor/election-interference-exposed-iranian-and-russian-cyber-tactics-in-the-spotlight-3e9059006021?source=rss------bug_bounty-5
WIRE TOR — The Ethical Hacking ServicesContinue reading on Medium » (https://medium.com/@wiretor/election-interference-exposed-iranian-and-russian-cyber-tactics-in-the-spotlight-3e9059006021?source=rss------bug_bounty-5)
Rhode Islanders’ Data Breach: Protect Yourself from Cyberattacks Today!
https://medium.com/@wiretor/rhode-islanders-data-breach-protect-yourself-from-cyberattacks-today-1c0f4f79b40b?source=rss------bug_bounty-5
https://medium.com/@wiretor/rhode-islanders-data-breach-protect-yourself-from-cyberattacks-today-1c0f4f79b40b?source=rss------bug_bounty-5
WIRE TOR — The Ethical Hacking ServicesContinue reading on Medium » (https://medium.com/@wiretor/rhode-islanders-data-breach-protect-yourself-from-cyberattacks-today-1c0f4f79b40b?source=rss------bug_bounty-5)
US Arrests Army Soldier Over AT&T, Verizon Hacking | Linked to Presidential Call Log Leaks
https://medium.com/@wiretor/us-arrests-army-soldier-over-at-t-verizon-hacking-linked-to-presidential-call-log-leaks-25897c6b4e0b?source=rss------bug_bounty-5
https://medium.com/@wiretor/us-arrests-army-soldier-over-at-t-verizon-hacking-linked-to-presidential-call-log-leaks-25897c6b4e0b?source=rss------bug_bounty-5
WIRE TOR — The Ethical Hacking ServicesContinue reading on Medium » (https://medium.com/@wiretor/us-arrests-army-soldier-over-at-t-verizon-hacking-linked-to-presidential-call-log-leaks-25897c6b4e0b?source=rss------bug_bounty-5)
Using CloudFlared for Tunneling and Persistence
https://www.reddit.com/r/redteamsec/comments/1hrvaj0/using_cloudflared_for_tunneling_and_persistence/
submitted by /u/Infosecsamurai (https://www.reddit.com/user/Infosecsamurai)
[link] (https://youtu.be/JC1hIppKLhI) [comments] (https://www.reddit.com/r/redteamsec/comments/1hrvaj0/using_cloudflared_for_tunneling_and_persistence/)
https://www.reddit.com/r/redteamsec/comments/1hrvaj0/using_cloudflared_for_tunneling_and_persistence/
submitted by /u/Infosecsamurai (https://www.reddit.com/user/Infosecsamurai)
[link] (https://youtu.be/JC1hIppKLhI) [comments] (https://www.reddit.com/r/redteamsec/comments/1hrvaj0/using_cloudflared_for_tunneling_and_persistence/)
Looking for a blue team partner
https://www.reddit.com/r/redteamsec/comments/1hrxwdd/looking_for_a_blue_team_partner/
<!-- SC_OFF -->Hey everyone, I’m actively working on improving my red team skills and would love to partner up with someone on the blue team side. My goal is to simulate realistic attacks and help sharpen defenses. If you’re looking to practice defending systems against simulated threats, feel free to reach out! We can collaborate, learn, and grow together. <!-- SC_ON --> submitted by /u/username7163620 (https://www.reddit.com/user/username7163620)
[link] (http://www.google.com/) [comments] (https://www.reddit.com/r/redteamsec/comments/1hrxwdd/looking_for_a_blue_team_partner/)
https://www.reddit.com/r/redteamsec/comments/1hrxwdd/looking_for_a_blue_team_partner/
<!-- SC_OFF -->Hey everyone, I’m actively working on improving my red team skills and would love to partner up with someone on the blue team side. My goal is to simulate realistic attacks and help sharpen defenses. If you’re looking to practice defending systems against simulated threats, feel free to reach out! We can collaborate, learn, and grow together. <!-- SC_ON --> submitted by /u/username7163620 (https://www.reddit.com/user/username7163620)
[link] (http://www.google.com/) [comments] (https://www.reddit.com/r/redteamsec/comments/1hrxwdd/looking_for_a_blue_team_partner/)
Evilginx detection
https://www.reddit.com/r/redteamsec/comments/1hrzywl/evilginx_detection/
<!-- SC_OFF -->Hi guys, I was testing Evilginx for a few days now, and I have faced an issue. When I enter the lure url into my chrome browser, I get a warning saying “Dangerous Site” from chrome. However it seems to work fine with other browsers. Is there a walk around to this? <!-- SC_ON --> submitted by /u/prath-10 (https://www.reddit.com/user/prath-10)
[link] (https://global.discourse-cdn.com/cloudflare/original/3X/9/0/90994131d155bbed4cf9f968d27cc8cae79d4752.png) [comments] (https://www.reddit.com/r/redteamsec/comments/1hrzywl/evilginx_detection/)
https://www.reddit.com/r/redteamsec/comments/1hrzywl/evilginx_detection/
<!-- SC_OFF -->Hi guys, I was testing Evilginx for a few days now, and I have faced an issue. When I enter the lure url into my chrome browser, I get a warning saying “Dangerous Site” from chrome. However it seems to work fine with other browsers. Is there a walk around to this? <!-- SC_ON --> submitted by /u/prath-10 (https://www.reddit.com/user/prath-10)
[link] (https://global.discourse-cdn.com/cloudflare/original/3X/9/0/90994131d155bbed4cf9f968d27cc8cae79d4752.png) [comments] (https://www.reddit.com/r/redteamsec/comments/1hrzywl/evilginx_detection/)
SQL Injection: A Beginner’s Guide PART 1
https://medium.com/@hamzamabdulrhman/sql-injection-a-beginners-guide-part-1-0bdb41ec8609?source=rss------bug_bounty-5
https://medium.com/@hamzamabdulrhman/sql-injection-a-beginners-guide-part-1-0bdb41ec8609?source=rss------bug_bounty-5
IntroductionContinue reading on Medium » (https://medium.com/@hamzamabdulrhman/sql-injection-a-beginners-guide-part-1-0bdb41ec8609?source=rss------bug_bounty-5)