All Thanks To My God - الحمد لله
Joined August 2022
- Tweets80
- Following0
- Followers652
- Likes63
TRACE HTTP Verb in Bug Hunting
It's very rare to find, but when you find the TRACE verb enabled in a web server, never skip searching for Information Disclosure, because the TRACE verb can disclose internal IP Addresses and internal HTTP headers sent by the reverse proxy
TTMG, I'm back for more...
Tip: AI hacking is not just Prompt Injection, just fuzz the server for hidden paths...
The bug get fixed, so I wanted to share the story...
Write-up Link:
7-th.github.io/posts/admin-p…
🧵Bug Bounty Diaries ( D6 )
It's still a VDP, but the chain was EPIC
=> From CSTI (Client-Side Template Injection) to XSS Gadget + WAF Bypass
=> From XSS to CSP Bypass
=> From CSP Bypass to fetch requests
=> From fetch requests to Cookie hijacking
🧵Bug Bounty Diaries ( D5 )
Stored-XSS in the user's first and last name fields
This was an old bug in a public bug bounty program, and it could be escalated to exfiltrate user cookies...
I wanted to add some information about Exploit 1. After testing the exploit on live targets and a local lab, I validated that the XSS payload will work only if it is a DOM-Based Open Redirect, and if it were a Server-Based Open Redirect, the browser will stop the XSS from running
🧵Bug Bounty Diaries ( D4 )
How to escalate an "Open Redirect" from P5 to P3 or P1
Yesterday, I found an Open Redirect in a public VDP, and I wanted to teach you the exploitation process that you should take before reporting the bug as a P5 ... thread...
🧵Bug Bounty Diaries ( D3 )
This was an EPIC hack...
TTMG, In this report, I was able to combine 2 vulnerabilities to bypass the login page of an admin portal and log in as an admin, without any username or password
Maybe more details in the future...
🧵Bug Bounty Diaries ( D2 )
Today, I found my first "Prototype Pollution" vulnerability in the wild, but it can't be a valid bug to be reported on its own, so when you find a PP, you should dig deeper to combine it with a gadget in order to build a valid report...
Mostafa Alrefai retweeted
You send the payload in the parameters part or the fragment part of the URL, to be a part of the document.URL source
🧵The Bug Bounty Diaries...
This is the first post of a New Series where I talk about bugs that I found in wild Bug Bounty Targets
This is a short story about a DOM-Based XSS that I found in a Private Bug Bounty Program, but it was unexploitable due to modern browser mechanisms
DOM-Based XSS is all about (Source + Sink). In this case, the sink was `document.write` and the source was `document.URL`
The problem is that the attack will only be valid if the payload was sent to the sink without URL encoding, as you can see the "alert box" in the screenshot.
[*] Bug Bounty Skills...
(More Parameters = More Vulnerabilities)
Did you know that there are 4 types of discovery techniques:
1. Website Crawling (Active)
2. Hidden Parameter Fuzzing (Active)
3. JavaScript Mining (Passive)
4. Searching Public Archives (Passive)
🧵Thread...
[*] Bug Hunting Wisdom...
Don't underestimate a bug ... Why?
Because it's not about the bug, it's all about the impact...
This case was plain text usernames and passwords due to a simple misconfiguration
