How We Discovered a Stored HTML Injection in a Chatbot System ️
This write-up has been prepared under the guidance of Amish Patel, Lay Patel at Hacker4Help as part of our learning initiative on cybersecurity awareness.🔍 Introduction As budding cybersecurity enthusiasts, we’re always on the lookout for vulnerable systems that can help us learn and sharpen our skills. One casual evening of testing led us — Het Patel and Kaif Shah — to discover a Stored HTML Injection vulnerability in the chatbot feature of redacted.co.in, an AI-driven platform that connects users with verified professional experts across various categories. So Let’s get started 😎What is Stored HTML Injection? 💥 Before we dive into the juicy details, let’s break down what Stored HTML Injection actually is (because not everyone speaks fluent hacker 🤓): Think of it like this: Imagine you’re at a restaurant and the waiter takes your order without questioning it. You ask for “spaghetti with a side of surprise ingredients” and the kitchen just… makes it. No questions asked. That’s essentially what happens with stored HTML injection! 🍝 Hence, Stored HTML Injection occurs when user-supplied HTML content is not properly sanitized and is saved in the application’s database. When this data is later rendered on a page, the HTML is executed directly, which could lead to defacements or further security issues such as phishing or XSS (if scripts are allowed). This can lead to:🎭 Page defacements (making websites look funky)🎣 Phishing attacks (tricking users)⚡ XSS vulnerabilities (if scripts sneak through)The Setup: Where We Found It 🧪 While exploring the AI chatbot feature of pyng.co.in, we noticed an input field where users could send messages. At first, it seemed harmless — but our curiosity nudged us to test how it handled raw HTML.Payload and Execution We entered the following simple HTML tag as our message:<h1>Hello from Het & Kaif</h1> To our surprise, when the chat history was loaded on page refresh or revisit, the message was rendered exactly as HTML — not escaped, not sanitized. This confirmed a stored HTML injection — the HTML was being stored server-side and rendered client-side without any filtering. We also tried several other payloads to confirm the injection:<b style="color:red">XSS</b> <i onclick="alert('XSS')">Click me</i> <div style="background:red;padding:10px">Injected DIV</div> <b style="color:red">XSS</b> However, since JavaScript execution was fully disabled, despite attempting multiple payloads and bypass techniques, we were unable to achieve any successful execution.Screenshot of Payload Execution📬 Responsible Disclosure We followed responsible disclosure practices:Reported the bug to the redacted.co.in team.Shared steps to reproduce and suggestions to mitigate. We did got the reply from support team: They were already aware of the vulnerability so they marked our report as “Duplicate Submission” 😭About the Authors:Het Patel — Cybersecurity Enthusiast | Bug Hunter | Coffee Addict ☕Kaif Shah — Security Researcher | CEHv11 | CRTA | Top 4% THM | Bug Hunter Happy Hacking! (Ethically, of course) 😉🔒 How We Discovered a Stored HTML Injection in a Chatbot System 🕷️ was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
This write-up has been prepared under the guidance of Amish Patel, Lay Patel at Hacker4Help as part of our learning initiative on cybersecurity awareness.🔍 Introduction As budding cybersecurity enthusiasts, we’re always on the lookout for vulnerable systems that can help us learn and sharpen our skills. One casual evening of testing led us — Het Patel and Kaif Shah — to discover a Stored HTML Injection vulnerability in the chatbot feature of redacted.co.in, an AI-driven platform that connects users with verified professional experts across various categories. So Let’s get started 😎What is Stored HTML Injection? 💥 Before we dive into the juicy details, let’s break down what Stored HTML Injection actually is (because not everyone speaks fluent hacker 🤓): Think of it like this: Imagine you’re at a restaurant and the waiter takes your order without questioning it. You ask for “spaghetti with a side of surprise ingredients” and the kitchen just… makes it. No questions asked. That’s essentially what happens with stored HTML injection! 🍝 Hence, Stored HTML Injection occurs when user-supplied HTML content is not properly sanitized and is saved in the application’s database. When this data is later rendered on a page, the HTML is executed directly, which could lead to defacements or further security issues such as phishing or XSS (if scripts are allowed). This can lead to:🎭 Page defacements (making websites look funky)🎣 Phishing attacks (tricking users)⚡ XSS vulnerabilities (if scripts sneak through)The Setup: Where We Found It 🧪 While exploring the AI chatbot feature of pyng.co.in, we noticed an input field where users could send messages. At first, it seemed harmless — but our curiosity nudged us to test how it handled raw HTML.Payload and Execution We entered the following simple HTML tag as our message:<h1>Hello from Het & Kaif</h1> To our surprise, when the chat history was loaded on page refresh or revisit, the message was rendered exactly as HTML — not escaped, not sanitized. This confirmed a stored HTML injection — the HTML was being stored server-side and rendered client-side without any filtering. We also tried several other payloads to confirm the injection:<b style="color:red">XSS</b> <i onclick="alert('XSS')">Click me</i> <div style="background:red;padding:10px">Injected DIV</div> <b style="color:red">XSS</b> However, since JavaScript execution was fully disabled, despite attempting multiple payloads and bypass techniques, we were unable to achieve any successful execution.Screenshot of Payload Execution📬 Responsible Disclosure We followed responsible disclosure practices:Reported the bug to the redacted.co.in team.Shared steps to reproduce and suggestions to mitigate. We did got the reply from support team: They were already aware of the vulnerability so they marked our report as “Duplicate Submission” 😭About the Authors:Het Patel — Cybersecurity Enthusiast | Bug Hunter | Coffee Addict ☕Kaif Shah — Security Researcher | CEHv11 | CRTA | Top 4% THM | Bug Hunter Happy Hacking! (Ethically, of course) 😉🔒 How We Discovered a Stored HTML Injection in a Chatbot System 🕷️ was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Medium
How We Discovered a Stored HTML Injection in a Chatbot System 🕷️
What happens when you feed HTML to a hungry chatbot? Spoiler: It gets digested without question!
Insecure by Design: How a Mobile API Let Me Reset Anyone’s Password With Just a Phone Number
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Hey there!😁Continue reading on InfoSec Write-ups »
Read more...
Medium
📱 Insecure by Design: How a Mobile API Let Me Reset Anyone’s Password With Just a Phone Number 🔓
Hey there!😁
How to use “Caido Workflows” to scan for anything
Caido Workflow Coloring How to build Caido passive workflows to scan all HTTP requests & responses… In this tutorial, I will guide you through the steps to build your custom Caido Workflows, which can help you identify bugs based on your methodology… You can scan for patterns like API keys or tokens, or take it to the next level by integrating it with “Match & Replace” rules to inject payloads and match for high-impact bugs, such as OS command injection.Steps to create a new workflow There are two types of Caido workflows:Passive workflows will run on all requests that will pass through Caido.Active workflows will wait until you choose a request and run that workflow manually on it. In this tutorial, we will create a simple “passive workflow” that will scan for JWTs (JSON Web Tokens) in all responses. When it finds a token, it assigns the request a special color and creates a new finding.First, go to the “Workflows tab”, choose the passive tab, and click “New Workflow”By default, you will find the first step in the workflow layers as “On intercept request”; in our case, we want to scan the responses, so we will replace this first step with “On Intercept Response”.Make sure to choose the “On Intercept Response” as first step 3. The second step in the workflow is “Matches HTTPQL”. In the query (code), we will match for JWTs using the following regex query:resp.raw.regex:/eyJa-zA-Z0-9{10,}\.eyJa-zA-Z0-9{10,}\.a-zA-Z0-9\_\-{10,}/Step 3 4. After that, we will add the “Create Finding” and fill in the finding details like the following: 5. The last step is the “Set Color” step, which will change the color of the request that matches the query in the HTTP history tab. Here we can use a website like https://htmlcolorcodes.com/ to choose our preferred colors. In this example, we can pick a blue color with code (#2874a6)The code is the string after the # We can test the final setup with the new feature in Caido V0.50.0, or we can test it with the following JWT PortSwigger lab.New Caido future to test the new workflow Finally, this is a very simple example to make it easy for you to set up your scans, which can be more advanced.Additional Tip If you want to test for bugs like IDOR (Insecure Direct Object Reference) or Web Cache Deception, you should test each endpoint that will respond with the user’s email address. To easily filter these endpoints, you can create a new Caido passive workflow, but you will change the “Matches HTTPQL” to match the email that you used to create the account. Normally, if you are doing bug bounty, you will sign up with the platform’s hunting email, so I created the following HTTPQL regex query that will match for the hunting emails of HackerOne, Bugcrowd, and Intigriti.resp.raw.regex:"(a-zA-Z1-9{1,}+{0,1}a-zA-Z1-9{0,}@bugcrowdninja.com|a-zA-Z1-9{1,}+{0,1}a-zA-Z1-9{0,}@wearehackerone.com|a-zA-Z1-9{1,}+{0,1}a-zA-Z1-9{0,}@intigriti.me)" If you don’t want to create a full Caido workflow, you can use this HTTPQL query in the Caido search tab to filter these endpoints quickly. For more info on Caido workflows, you can take a look at the Caido docs. If you want to follow for more -> https://x.com/_the7th How to use “Caido Workflows” to scan for anything was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Caido Workflow Coloring How to build Caido passive workflows to scan all HTTP requests & responses… In this tutorial, I will guide you through the steps to build your custom Caido Workflows, which can help you identify bugs based on your methodology… You can scan for patterns like API keys or tokens, or take it to the next level by integrating it with “Match & Replace” rules to inject payloads and match for high-impact bugs, such as OS command injection.Steps to create a new workflow There are two types of Caido workflows:Passive workflows will run on all requests that will pass through Caido.Active workflows will wait until you choose a request and run that workflow manually on it. In this tutorial, we will create a simple “passive workflow” that will scan for JWTs (JSON Web Tokens) in all responses. When it finds a token, it assigns the request a special color and creates a new finding.First, go to the “Workflows tab”, choose the passive tab, and click “New Workflow”By default, you will find the first step in the workflow layers as “On intercept request”; in our case, we want to scan the responses, so we will replace this first step with “On Intercept Response”.Make sure to choose the “On Intercept Response” as first step 3. The second step in the workflow is “Matches HTTPQL”. In the query (code), we will match for JWTs using the following regex query:resp.raw.regex:/eyJa-zA-Z0-9{10,}\.eyJa-zA-Z0-9{10,}\.a-zA-Z0-9\_\-{10,}/Step 3 4. After that, we will add the “Create Finding” and fill in the finding details like the following: 5. The last step is the “Set Color” step, which will change the color of the request that matches the query in the HTTP history tab. Here we can use a website like https://htmlcolorcodes.com/ to choose our preferred colors. In this example, we can pick a blue color with code (#2874a6)The code is the string after the # We can test the final setup with the new feature in Caido V0.50.0, or we can test it with the following JWT PortSwigger lab.New Caido future to test the new workflow Finally, this is a very simple example to make it easy for you to set up your scans, which can be more advanced.Additional Tip If you want to test for bugs like IDOR (Insecure Direct Object Reference) or Web Cache Deception, you should test each endpoint that will respond with the user’s email address. To easily filter these endpoints, you can create a new Caido passive workflow, but you will change the “Matches HTTPQL” to match the email that you used to create the account. Normally, if you are doing bug bounty, you will sign up with the platform’s hunting email, so I created the following HTTPQL regex query that will match for the hunting emails of HackerOne, Bugcrowd, and Intigriti.resp.raw.regex:"(a-zA-Z1-9{1,}+{0,1}a-zA-Z1-9{0,}@bugcrowdninja.com|a-zA-Z1-9{1,}+{0,1}a-zA-Z1-9{0,}@wearehackerone.com|a-zA-Z1-9{1,}+{0,1}a-zA-Z1-9{0,}@intigriti.me)" If you don’t want to create a full Caido workflow, you can use this HTTPQL query in the Caido search tab to filter these endpoints quickly. For more info on Caido workflows, you can take a look at the Caido docs. If you want to follow for more -> https://x.com/_the7th How to use “Caido Workflows” to scan for anything was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
HTML Color Codes
Get HTML color codes, Hex color codes, RGB, HSL and OKLCH values with our color pickers, color wheel, color chart and HTML color names. Let's go!
“IDOR Attacks Unmasked: Code Exploits and Real-World Breaches”
Hey, I’m Aman Sharma, a cybersecurity enthusiast. While testing web apps, I discovered how IDOR (Insecure Direct Object Reference) can…Continue reading on InfoSec Write-ups »
Read more...
Hey, I’m Aman Sharma, a cybersecurity enthusiast. While testing web apps, I discovered how IDOR (Insecure Direct Object Reference) can…Continue reading on InfoSec Write-ups »
Read more...
Medium
“IDOR Attacks Unmasked: Code Exploits and Real-World Breaches”
Hey, I’m Aman Sharma, a cybersecurity enthusiast. While testing web apps, I discovered how IDOR (Insecure Direct Object Reference) can turn…
Week 6 — Learning Basic Concepts of Cybersecurity
Aang Remains frozen for 100 Years.Continue reading on Medium »
Read more...
Aang Remains frozen for 100 Years.Continue reading on Medium »
Read more...
Medium
Week 6 — Learning Basic Concepts of Cybersecurity
Aang Remains frozen for 100 Years.
“Bug Bounty ”Telerik Report Server Authentication Bypass — CVE-2024–4358 “POC”
https://medium.com/@hariharanhex00/bug-bounty-telerik-report-server-authentication-bypass-cve-2024-4358-poc-358575ed7102?source=rss------bug_bounty-5
https://medium.com/@hariharanhex00/bug-bounty-telerik-report-server-authentication-bypass-cve-2024-4358-poc-358575ed7102?source=rss------bug_bounty-5
Telerik Report Server Tool that helps to businesses to store, manage and share the reports in one Central placeContinue reading on Medium » (https://medium.com/@hariharanhex00/bug-bounty-telerik-report-server-authentication-bypass-cve-2024-4358-poc-358575ed7102?source=rss------bug_bounty-5)
Parameter Tampering on a Govt. site
https://medium.com/@bagade1122/parameter-tampering-on-a-govt-site-b5a7c6a5490c?source=rss------bug_bounty-5
https://medium.com/@bagade1122/parameter-tampering-on-a-govt-site-b5a7c6a5490c?source=rss------bug_bounty-5
One day I received an email to make payment for my home electricity connection.
I had 2 options to make the payment of ₹ 610 via UPI or…Continue reading on Medium » (https://medium.com/@bagade1122/parameter-tampering-on-a-govt-site-b5a7c6a5490c?source=rss------bug_bounty-5)
I had 2 options to make the payment of ₹ 610 via UPI or…Continue reading on Medium » (https://medium.com/@bagade1122/parameter-tampering-on-a-govt-site-b5a7c6a5490c?source=rss------bug_bounty-5)
Week 6 — Learning Basic Concepts of Cybersecurity
https://iamaangx028.medium.com/week-6-learning-basic-concepts-of-cybersecurity-d2a27e136f24?source=rss------bug_bounty-5
https://iamaangx028.medium.com/week-6-learning-basic-concepts-of-cybersecurity-d2a27e136f24?source=rss------bug_bounty-5
Aang Remains frozen for 100 Years.Continue reading on Medium » (https://iamaangx028.medium.com/week-6-learning-basic-concepts-of-cybersecurity-d2a27e136f24?source=rss------bug_bounty-5)
AI-Assisted Insecurity: Forging JWTs from Auto-Generated Weak Secrets
https://saeed0x1.medium.com/ai-assisted-insecurity-forging-jwts-from-auto-generated-weak-secrets-9a6db38b14ad?source=rss------bug_bounty-5
https://saeed0x1.medium.com/ai-assisted-insecurity-forging-jwts-from-auto-generated-weak-secrets-9a6db38b14ad?source=rss------bug_bounty-5
This article walks through a real-world JWT forgery vulnerability caused by a weak, AI-generated secret.Continue reading on Medium » (https://saeed0x1.medium.com/ai-assisted-insecurity-forging-jwts-from-auto-generated-weak-secrets-9a6db38b14ad?source=rss------bug_bounty-5)
AI-Assisted Insecurity: Forging JWTs from Auto-Generated Weak Secrets
This article walks through a real-world JWT forgery vulnerability caused by a weak, AI-generated secret.Continue reading on Medium »
Read more...
This article walks through a real-world JWT forgery vulnerability caused by a weak, AI-generated secret.Continue reading on Medium »
Read more...
Medium
AI-Assisted Insecurity: Forging JWTs from Auto-Generated Weak Secrets
This article walks through a real-world JWT forgery vulnerability caused by a weak, AI-generated secret.
Host Validation Bypass via Connection State Attack: Multiple Requests Over the Same TCP Connection
Discover how persistent connections and weak Host validation open the doors to internal systems.Continue reading on InfoSec Write-ups »
Read more...
Discover how persistent connections and weak Host validation open the doors to internal systems.Continue reading on InfoSec Write-ups »
Read more...
Medium
Host Validation Bypass via Connection State Attack: Multiple Requests Over the Same TCP Connection
Discover how persistent connections and weak Host validation open the doors to internal systems.
Host Validation Bypass via Connection State Attack: Multiple Requests Over the Same TCP Connection
https://infosecwriteups.com/host-validation-bypass-via-connection-state-attack-multiple-requests-over-the-same-tcp-connection-9fc2406d2fe1?source=rss------bug_bounty-5
https://infosecwriteups.com/host-validation-bypass-via-connection-state-attack-multiple-requests-over-the-same-tcp-connection-9fc2406d2fe1?source=rss------bug_bounty-5
Discover how persistent connections and weak Host validation open the doors to internal systems.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/host-validation-bypass-via-connection-state-attack-multiple-requests-over-the-same-tcp-connection-9fc2406d2fe1?source=rss------bug_bounty-5)