Discover and read the best of Twitter Threads about #Learn365
Most recents (24)
1. alert`1`
Use backquotes.
Use backquotes.
#bugbountytips #learn #learn365 #SSRF
Let's learn SSRF in a Thread 🧵
Here is my notes on SSRF (Just Basics) ->
Let's learn SSRF in a Thread 🧵
Here is my notes on SSRF (Just Basics) ->
SSRF → Server Side Request Forgery Attack
In this attack, vulnerable server accept user’s request without filtering and thus trusting user’s input and give back response to user
In this attack, vulnerable server accept user’s request without filtering and thus trusting user’s input and give back response to user
Attacker forge the request in such a way that server accept it thinking it as legit and give the response what the attacker want
Actually , these days , server is around many technologies like → Internal Network, WAF, Databases etc
Actually , these days , server is around many technologies like → Internal Network, WAF, Databases etc
#Learn365 - Day 1⃣ 7⃣
Since we are talking about Polyglots, today I have SQLi Polyglot for you.
A context insensitive sqli payload polyglot, a thread. 🧵👇
#infosec #appsec #bugbountytips #security
Since we are talking about Polyglots, today I have SQLi Polyglot for you.
A context insensitive sqli payload polyglot, a thread. 🧵👇
#infosec #appsec #bugbountytips #security
When it comes to SQLi, the SQli polygot is the payload that runs in context of ' (single quote) and " (double quote).
E.g
SLEEP(1) /*' or SLEEP(1) or'" or SLEEP(1) or "*/
Will execute in both the contexts.
How ?
Let's see next.
E.g
SLEEP(1) /*' or SLEEP(1) or'" or SLEEP(1) or "*/
Will execute in both the contexts.
How ?
Let's see next.
MYSQL_QUERY = "SELECT * FROM users WHERE username = '<input>'" ;
Would turn into
MYSQL_QUERY = "SELECT * FROM users WHERE username = 'SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/" '";
Carefully observe, the Payload is happy.
Would turn into
MYSQL_QUERY = "SELECT * FROM users WHERE username = 'SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/" '";
Carefully observe, the Payload is happy.
#Learn365 - Day 1⃣ 6⃣
Can write single Exploit payload which can exploit both HTML and JS injection in this ?
Yes we can, they are POLYGLOT payloads.
A context sensitive injection payloads, a thread. 🧵👇
#infosec #appsec #bugbountytips #security
Can write single Exploit payload which can exploit both HTML and JS injection in this ?
Yes we can, they are POLYGLOT payloads.
A context sensitive injection payloads, a thread. 🧵👇
#infosec #appsec #bugbountytips #security
Polyglot payloads capable of executing in multiple contexts.
A simple Example:
Input is flowing through HTML and JavaScript contenxt both and HTML is executed first then JS.
If you design the payload with JS context, HTML parse would fail, and XSS wont execute.
A simple Example:
Input is flowing through HTML and JavaScript contenxt both and HTML is executed first then JS.
If you design the payload with JS context, HTML parse would fail, and XSS wont execute.
Which means you have to design your payload which can pass both the contexts and still execute.
In above case there are two contexts,
HTML
&
JS
First HTML context is executed.
Lets take a look at the payload now.
In above case there are two contexts,
HTML
&
JS
First HTML context is executed.
Lets take a look at the payload now.
#Learn365 - Day 6⃣
Can you identify and exploit the #security bug? 🤔
In today's thread lets learn about exploit writing 🧵👇
#infosec #appsec #bugbountytips #security
Can you identify and exploit the #security bug? 🤔
In today's thread lets learn about exploit writing 🧵👇
#infosec #appsec #bugbountytips #security
This is SQLi. easy to guess. Which field is vulnerable : username.
But the tricky part is how to exploit it.
If you disect the code, you would notice that SQL statement should always return one single word. Otherwise comparison will anyway fail in PHP code.
What next ?
But the tricky part is how to exploit it.
If you disect the code, you would notice that SQL statement should always return one single word. Otherwise comparison will anyway fail in PHP code.
What next ?
What do you think will happen if I input :
" or 1=1;--
Think first !!
.
.
.
.
.
.
This will make SQL return entire password column.
Inturn, PHP check will fail at line #2.
So, you have to make SQL statement return 1 single word, and that should be password which u can match.
" or 1=1;--
Think first !!
.
.
.
.
.
.
This will make SQL return entire password column.
Inturn, PHP check will fail at line #2.
So, you have to make SQL statement return 1 single word, and that should be password which u can match.
#Learn365 - Day 5⃣
CORS Headers. 🤔
What are they ? And how they bypass SOP ?
Learn about them in this thread 🧵👇
#infosec #bugbountytips #CORS #http
CORS Headers. 🤔
What are they ? And how they bypass SOP ?
Learn about them in this thread 🧵👇
#infosec #bugbountytips #CORS #http
In last thread, we talked about SOP, while SOP blocks the response, CORS is use to bypass SOP the most sensible way.
CORS is Cross Origin Resource Sharing.
It allows sharing response across different origins possible. Can we call it Bypassing SOP ?
Yes.
CORS is Cross Origin Resource Sharing.
It allows sharing response across different origins possible. Can we call it Bypassing SOP ?
Yes.
Lets say,
Domain A wants to Talk to Domain B for getting some information.
A
Domain A wants to Talk to Domain B for getting some information.
A
#Learn365 - Day 4⃣
SOP 🫧, Same Origin Policy.
A browser security framework that every #hacker should know.
Know what is it in this thread 🧵👇
#infosec #security #appsec #cybersecurity #SOP #http
SOP 🫧, Same Origin Policy.
A browser security framework that every #hacker should know.
Know what is it in this thread 🧵👇
#infosec #security #appsec #cybersecurity #SOP #http
SOP is browser security model, and I find lot of folks out there, who still dont understand it in and out.
Let me cover it here, in few threads.
Let's Start.
Let me cover it here, in few threads.
Let's Start.
It is a browser security model 🔥. Now what does that means ?
It simply means this control is enforced by browser to make user visiting a site more secure from attackers.
Browser creates virtual boundaries to segregate sites and this boundary is identified with ORIGINS.
It simply means this control is enforced by browser to make user visiting a site more secure from attackers.
Browser creates virtual boundaries to segregate sites and this boundary is identified with ORIGINS.
#securityexplained S-32: Account Takeover Methodologies
A thread on my Account Takeover Methodologies 🧵
[1/n]
#appsec #infosec #webappsec #bugbountytips #bugbounty #hacking #Coding #security #development #securecoding #learn365 #securityexplained
A thread on my Account Takeover Methodologies 🧵
[1/n]
#appsec #infosec #webappsec #bugbountytips #bugbounty #hacking #Coding #security #development #securecoding #learn365 #securityexplained
[2/n]
An account takeover usually refers to gaining persistent access to the victim user's account and performing all the authentication actions as a victim would be able to do. The severity of account takeover issues is usually considered between High to Critical.
An account takeover usually refers to gaining persistent access to the victim user's account and performing all the authentication actions as a victim would be able to do. The severity of account takeover issues is usually considered between High to Critical.
[3/n]
However, it also depends upon the complexity and likelihood of the attack.
In general, the account takeover is not a "vulnerability class" itself but an impact result of a vulnerability.
However, it also depends upon the complexity and likelihood of the attack.
In general, the account takeover is not a "vulnerability class" itself but an impact result of a vulnerability.
#SecurityExplained S-1: Web Testing Methodology
The below thread contains an overview of my pentesting methodology on the web application targets:
1. Initially, before starting with the engagement, I start with "Scoping" .........
(1/n)
The below thread contains an overview of my pentesting methodology on the web application targets:
1. Initially, before starting with the engagement, I start with "Scoping" .........
(1/n)
(2/n)
where I go through the details shared by the client to understand the scope and see if the testing is feasible as per the given timeline. During this phase, I also check if the application is accessible and credentials (if required) are working properly.
where I go through the details shared by the client to understand the scope and see if the testing is feasible as per the given timeline. During this phase, I also check if the application is accessible and credentials (if required) are working properly.
(3/n)
If any of the things from "Step-1" are blocking, I reach out to the concerned person and request to unblock the blocking items.
2. Next, I start browsing the application while letting the traffic flow through Burp Suite to populate the "Target" menu.
If any of the things from "Step-1" are blocking, I reach out to the concerned person and request to unblock the blocking items.
2. Next, I start browsing the application while letting the traffic flow through Burp Suite to populate the "Target" menu.
🚨🚨 Another 10K giveaway
50 Like - Burp Suite Ext Dev - 10 Coupons
100 Likes - SOP Zine - 10 Coupons
150 Likes - Web Auth Zines- 10 Coupons
200 Likes - Bundle - 3 Coupons
Thanks to @FeedHive_io for post conditions functionality.
#Security #Learn365 #bugbountytips #bugbounty
50 Like - Burp Suite Ext Dev - 10 Coupons
100 Likes - SOP Zine - 10 Coupons
150 Likes - Web Auth Zines- 10 Coupons
200 Likes - Bundle - 3 Coupons
Thanks to @FeedHive_io for post conditions functionality.
#Security #Learn365 #bugbountytips #bugbounty
Woah we hit 50 Likes, here is the link for Burp Suite Plugin Development Guide : securityzines.gumroad.com/l/burp-plugin-…
Only 10 Grab Fast.
Only 10 Grab Fast.
Woah we hit 100 Likes, here is the link for SOP Zine : securityzines.gumroad.com/l/sopzine/21so…
Only 10 Grab Fast.
Only 10 Grab Fast.
#learn365 Day-31: Captcha Bypass Techniques
Captcha is widely adapted by the applications to avoid automated attempts on specific functionality, commonly on the Authentication forms to avoid brute-force attacks.
#bugbountytips #appsec #infosec #Pentesting
(1/n)
Captcha is widely adapted by the applications to avoid automated attempts on specific functionality, commonly on the Authentication forms to avoid brute-force attacks.
#bugbountytips #appsec #infosec #Pentesting
(1/n)
(2/n)
However, it is possible to bypass Captcha, and sometimes if the function is critical, it can be paid well in terms of bounties.
1. Missing Server-Sides Validation
- Some apps send Captcha Parameters on the client-side but they do not validate this on the server side.
However, it is possible to bypass Captcha, and sometimes if the function is critical, it can be paid well in terms of bounties.
1. Missing Server-Sides Validation
- Some apps send Captcha Parameters on the client-side but they do not validate this on the server side.
(3/n)
- Simply, Remove the "Captcha" parameters and see if the request is processed successfully.
- If yes, you can now use this request to perform your brute-force or rate-limiting attempts.
- Simply, Remove the "Captcha" parameters and see if the request is processed successfully.
- If yes, you can now use this request to perform your brute-force or rate-limiting attempts.
#learn365 Day-30: Common Business Logic Issues (Wrap)
(Cont'd...)
9. Parameter Tampering
- Tamper Payment or Critical Fields to manipulate their values
- Add multiple fields or unexpected fields by abusing HTTP Parameter Pollution & Mass Assignment
#bugbountytips #appsec
(1/n)
(Cont'd...)
9. Parameter Tampering
- Tamper Payment or Critical Fields to manipulate their values
- Add multiple fields or unexpected fields by abusing HTTP Parameter Pollution & Mass Assignment
#bugbountytips #appsec
(1/n)
(2/n)
- Response Manipulation to bypass certain restrictions such as 2FA Bypass
10. App Implementation Logic Abuse
- If an app accepts JSON data, try changing content type to XML and see if the XML data is being processed, it can be left vulnerable to XXE or XML-based attacks.
- Response Manipulation to bypass certain restrictions such as 2FA Bypass
10. App Implementation Logic Abuse
- If an app accepts JSON data, try changing content type to XML and see if the XML data is being processed, it can be left vulnerable to XXE or XML-based attacks.
(3/n)
- If an application is using the DELETE method to delete a resource but there is no CSRF protection, try converting the method to GET/POST and add an additional parameter like ?method=delete
- If an application is using the DELETE method to delete a resource but there is no CSRF protection, try converting the method to GET/POST and add an additional parameter like ?method=delete
#learn365 Day-29: Common Business Logic Issues (Part - 2)
(cont'd...)
5. Premium Feature Abuse
- Try forcefully browsing the areas or some particular endpoints which come under premium accounts.
#bugbountytips #AppSec #infosec #pentest
(1/n)
(cont'd...)
5. Premium Feature Abuse
- Try forcefully browsing the areas or some particular endpoints which come under premium accounts.
#bugbountytips #AppSec #infosec #pentest
(1/n)
(2/n)
- Pay for a premium feature and cancel your subscription. If you get a refund but the feature is still usable, it's a monetary impact issue.
- Some applications use true-false request/response values to validate if a user is having access to premium features or not.
- Pay for a premium feature and cancel your subscription. If you get a refund but the feature is still usable, it's a monetary impact issue.
- Some applications use true-false request/response values to validate if a user is having access to premium features or not.
(3/n)
- Try using Burp's Match & Replace to see if you can replace these values whenever you browse the app & access the premium features.
- Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not.
- Try using Burp's Match & Replace to see if you can replace these values whenever you browse the app & access the premium features.
- Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not.
#learn365 Common Business Logic Issues: Part-1
I'll try to cover some of the interesting business logic flaws that I usually test and have encountered so far today & in the next couple of days. Feel free to add more if you know any.
#bugbountytips #appsec #websecurity
(1/n)
I'll try to cover some of the interesting business logic flaws that I usually test and have encountered so far today & in the next couple of days. Feel free to add more if you know any.
#bugbountytips #appsec #websecurity
(1/n)
(2/n)
1. Review Functionality
- Some applications have an option where verified reviews are marked with some tick or it's mentioned. Try to see if you can post a review as a Verified Reviewer without purchasing that product.
1. Review Functionality
- Some applications have an option where verified reviews are marked with some tick or it's mentioned. Try to see if you can post a review as a Verified Reviewer without purchasing that product.
(3/n)
- Some app provides you with an option to provide a rating on a scale of 1 to 5, try to go beyond/below the scale-like provide 0 or 6 or -ve.
- Try to see if the same user can post multiple ratings for a product. This is an interesting endpoint to check for Race Conditions.
- Some app provides you with an option to provide a rating on a scale of 1 to 5, try to go beyond/below the scale-like provide 0 or 6 or -ve.
- Try to see if the same user can post multiple ratings for a product. This is an interesting endpoint to check for Race Conditions.
#learn365 Day-22: Password Reset Token Issues
1. Weak Cryptography in Password Reset Tokens
- Always check randomness in password reset tokens. It is also a good idea to check password reset tokens against known schemes.
Ref: medium.com/bugbountywrite…
#bugbountytips
(1/n)
1. Weak Cryptography in Password Reset Tokens
- Always check randomness in password reset tokens. It is also a good idea to check password reset tokens against known schemes.
Ref: medium.com/bugbountywrite…
#bugbountytips
(1/n)
(2/n)
2. Reusable Password Reset Tokens
- Use the token once and try to re-use it again.
- Request a new token and try if the old one is still active.
- Check how long a token stays alive. If it's >1 day and is reusable, you may report it.
2. Reusable Password Reset Tokens
- Use the token once and try to re-use it again.
- Request a new token and try if the old one is still active.
- Check how long a token stays alive. If it's >1 day and is reusable, you may report it.
(3/n)
3. IDOR (ATO)
- In the password reset link, assume there is something like this:
harshbothra.tech/reset?token=so…
- try changing the value of the user parameter to the victim and see If the attack token can be used for resetting the victim's password.
harshbothra.tech/reset?token=so…
3. IDOR (ATO)
- In the password reset link, assume there is something like this:
harshbothra.tech/reset?token=so…
- try changing the value of the user parameter to the victim and see If the attack token can be used for resetting the victim's password.
harshbothra.tech/reset?token=so…
#learn365 Day-22: GraphQL Part - 3 WrapUp
Pentesting GraphQL may look hard if you are not familiar but there is still a lot to explore and exploit once you understand how it works. Today, It's all about continue reading and some good resources.
#bugbountytips #appsec
(1/n)
Pentesting GraphQL may look hard if you are not familiar but there is still a lot to explore and exploit once you understand how it works. Today, It's all about continue reading and some good resources.
#bugbountytips #appsec
(1/n)
(2/n)
# Resources
- security-simplified.com/blog/NDY/graph…
-
- pentestpartners.com/security-blog/…
- threatninja.net/tutorial-on-gr…
- labs.bishopfox.com/tech-blog/desi…
- hackerone.com/reports/885539
- hackerone.com/reports/645299
- hackerone.com/reports/419883
- hackerone.com/reports/614355
- hackerone.com/reports/633001
# Resources
- security-simplified.com/blog/NDY/graph…
-
- pentestpartners.com/security-blog/…
- threatninja.net/tutorial-on-gr…
- labs.bishopfox.com/tech-blog/desi…
- hackerone.com/reports/885539
- hackerone.com/reports/645299
- hackerone.com/reports/419883
- hackerone.com/reports/614355
- hackerone.com/reports/633001
(3/n)
- hackerone.com/reports/489146
- hackerone.com/reports/608656
- hackerone.com/reports/423388
- hackerone.com/reports/707433
- hackerone.com/reports/417170
- hackerone.com/reports/800231
- hackerone.com/reports/924914
- hackerone.com/reports/898528
- hackerone.com/reports/978143
- hackerone.com/reports/715192
- hackerone.com/reports/489146
- hackerone.com/reports/608656
- hackerone.com/reports/423388
- hackerone.com/reports/707433
- hackerone.com/reports/417170
- hackerone.com/reports/800231
- hackerone.com/reports/924914
- hackerone.com/reports/898528
- hackerone.com/reports/978143
- hackerone.com/reports/715192
#learn365 Day-21: GraphQL Vulnerabilities (Part-2)
1. Information Disclosure via Error Messages
- Similar to the normal information disclosure via error triggering.
- Provide malformed or unexpected input within GraphQL queries.
#BugBountyTips #appsec #infosecurity
(1/n)
1. Information Disclosure via Error Messages
- Similar to the normal information disclosure via error triggering.
- Provide malformed or unexpected input within GraphQL queries.
#BugBountyTips #appsec #infosecurity
(1/n)
(2/n)
- Sometimes you may observe verbose error messages revealing sensitive information.
2. GraphQL Denial of Service
- Due to an improper limit on the maximum query depth, it might be possible to perform a denial of service in graphql implementation.
- Sometimes you may observe verbose error messages revealing sensitive information.
2. GraphQL Denial of Service
- Due to an improper limit on the maximum query depth, it might be possible to perform a denial of service in graphql implementation.
(3/n)
- Nest a query to unlimited depth and send this query on a GraphQL endpoint to observe anything suspicious.
- A good example: owasp-skf.gitbook.io/asvs-write-ups…
3. Insecure Direct Object Reference
- Similar to normal API like IDORs
- A good example: owasp-skf.gitbook.io/asvs-write-ups…
- Nest a query to unlimited depth and send this query on a GraphQL endpoint to observe anything suspicious.
- A good example: owasp-skf.gitbook.io/asvs-write-ups…
3. Insecure Direct Object Reference
- Similar to normal API like IDORs
- A good example: owasp-skf.gitbook.io/asvs-write-ups…
#learn365 Day-20: GraphQL Series Part - 1
- GraphQL is a query language for the underlying API.
- A single endpoint can be used as a query API to perform all the actions including Create, Read, Update & Delete.
#bugbountytips #appsec #infosec
(1/n)
- GraphQL is a query language for the underlying API.
- A single endpoint can be used as a query API to perform all the actions including Create, Read, Update & Delete.
#bugbountytips #appsec #infosec
(1/n)
(2/n)
- GraphQL has its own type of system that’s used to define the schema of an API. The syntax for writing schemas is called Schema Definition Language (SDL).
# A GraphQL operation can be of type:
1. query (a read-only fetch)
2. mutation (a write followed by fetch)
- GraphQL has its own type of system that’s used to define the schema of an API. The syntax for writing schemas is called Schema Definition Language (SDL).
# A GraphQL operation can be of type:
1. query (a read-only fetch)
2. mutation (a write followed by fetch)
(3/n)
3. subscription (a long‐lived request that fetches data in response to source events.)
- A GraphQL document can contain one or more of these operations (i.e multiple queries/mutations/subscriptions).
- Mutations queries modify data in the data store and returns a value.
3. subscription (a long‐lived request that fetches data in response to source events.)
- A GraphQL document can contain one or more of these operations (i.e multiple queries/mutations/subscriptions).
- Mutations queries modify data in the data store and returns a value.
#learn365 Day-13: WebSocket Vulns (Intro)
WebSocket is a network protocol that enables 2-way communication b/w client & server. In the HTTP standard, where the one-party has to wait for the req./res from another party before performing the next action.
#bugbountytips
(1/n)
WebSocket is a network protocol that enables 2-way communication b/w client & server. In the HTTP standard, where the one-party has to wait for the req./res from another party before performing the next action.
#bugbountytips
(1/n)
(2/n)
The major goal of WebSocket is to enable real-time communication and can widely be seen in IM applications.
I will be diving the WebSocket learning into 3 parts and I will post more about various attacks in the next two days.
The major goal of WebSocket is to enable real-time communication and can widely be seen in IM applications.
I will be diving the WebSocket learning into 3 parts and I will post more about various attacks in the next two days.
(3/n)
# Web socket Protocol Scheme
1. Websockets use wss:// and ws:// as the protocol scheme.
2. This is similar to HTTPS and HTTP. Here, the WSS:// is a secure channel where WS:// is an insecure channel.
# Web socket Protocol Scheme
1. Websockets use wss:// and ws:// as the protocol scheme.
2. This is similar to HTTPS and HTTP. Here, the WSS:// is a secure channel where WS:// is an insecure channel.
#learn365 Day-12: Unicode Normalization
This attack is hard to explain w/o proper graphics. Please refer to the references mentioned for a detailed explanation. This is a really good attack vector to try and consider while doing PT/BB.
(1/n)
#bugbountytips #AppSec #infosec
This attack is hard to explain w/o proper graphics. Please refer to the references mentioned for a detailed explanation. This is a really good attack vector to try and consider while doing PT/BB.
(1/n)
#bugbountytips #AppSec #infosec
(2/n)
Unicode to ASCII Transformation is a two-step process.
1. Normalization: Where the characters are converted to a standardized form
2. Punycoding: Where the Unicode is turned into ASCII
There are two overall types of equivalence between characters:......
Unicode to ASCII Transformation is a two-step process.
1. Normalization: Where the characters are converted to a standardized form
2. Punycoding: Where the Unicode is turned into ASCII
There are two overall types of equivalence between characters:......
(3/n)
1. Canonical Equivalence: Characters are assumed to have the same appearance and meaning when printed or displayed.
2. Compatibility Equivalence: This is a weaker equivalence, in that two values may represent the same abstract character but can be displayed differently.
1. Canonical Equivalence: Characters are assumed to have the same appearance and meaning when printed or displayed.
2. Compatibility Equivalence: This is a weaker equivalence, in that two values may represent the same abstract character but can be displayed differently.
#Learn365 Day-11: Cache Poisoned Denial of Service (CPDos)
AIO Resource: cpdos.org
- One of a kind of Web Cache Poisoning attack that affects the resources used by an application to create a denial of service situation.
#bugbountytips #AppSec #infosec
(1/n)
AIO Resource: cpdos.org
- One of a kind of Web Cache Poisoning attack that affects the resources used by an application to create a denial of service situation.
#bugbountytips #AppSec #infosec
(1/n)
(2/n)
# Working
The working of this attack is theoretically very simple to understand:
1. The attacker sends a request to the server containing a malicious header with a malicious value. This can be any random header.
ex: x-mal-example: tohackthehacker
# Working
The working of this attack is theoretically very simple to understand:
1. The attacker sends a request to the server containing a malicious header with a malicious value. This can be any random header.
ex: x-mal-example: tohackthehacker
(3/n)
2. This request is first processed by the intermediate cache server to check if the copy exists.
3. The cache server forwards the attacker's request with malicious headers to the origin server as it doesn't store a fresh copy of the requested resource.
2. This request is first processed by the intermediate cache server to check if the copy exists.
3. The cache server forwards the attacker's request with malicious headers to the origin server as it doesn't store a fresh copy of the requested resource.
#Learn365 Day - 8: JSONP Attack
(Deleted prev. post and re-sharing as there are some modifications & to avoid false statement)
JSONP stands for JavaScript Object Notation with Padding which allows sending JSON data across domains without worrying about Cross-Domain Issues. (1/n)
(Deleted prev. post and re-sharing as there are some modifications & to avoid false statement)
JSONP stands for JavaScript Object Notation with Padding which allows sending JSON data across domains without worrying about Cross-Domain Issues. (1/n)
(2/n)
It utilizes <script> tag to perform the action instead of using XHR. However, the function requires to be existing in the global scope.
It is an insecure communication method & should be used when no personal/sensitive data is involved & sanitizing the callback function.
It utilizes <script> tag to perform the action instead of using XHR. However, the function requires to be existing in the global scope.
It is an insecure communication method & should be used when no personal/sensitive data is involved & sanitizing the callback function.
(3/n)There are multiple attacks affecting the JSONP implementation as it doesn't have a security feature.
The “padding” or function to call with the JSON data, is often specified as a parameter. Often this parameter is called callback and is reflected as-is in the response.
The “padding” or function to call with the JSON data, is often specified as a parameter. Often this parameter is called callback and is reflected as-is in the response.
#learn365 Day-7: Cross-Site Script Inclusion (XSSI)
- XSS & XSSI are differemt.
In XSS, the payload is included on the victim to perform an action. However, In the case of XSSI, the victim's code (JS) is embedded in the attacker-controlled page.
#BugBountyTips #infosec (1/n)
- XSS & XSSI are differemt.
In XSS, the payload is included on the victim to perform an action. However, In the case of XSSI, the victim's code (JS) is embedded in the attacker-controlled page.
#BugBountyTips #infosec (1/n)
(2/n)
In XSSI, the goal is to usually steal the data bypassing the restrictions such as the Same Origin Policy (SOP).
XSSI is less utilized and I never paid much attention to this attack vector. This seems to be an interesting and realistic, easy to exploit attack vector.
In XSSI, the goal is to usually steal the data bypassing the restrictions such as the Same Origin Policy (SOP).
XSSI is less utilized and I never paid much attention to this attack vector. This seems to be an interesting and realistic, easy to exploit attack vector.
(3/n)
This attack is to mainly target the sensitive information that might get dynamically stored in the javascript files when a user performs some activity. If there are not proper restrictions set, an attacker can easily read and get hold of sensitive information.
This attack is to mainly target the sensitive information that might get dynamically stored in the javascript files when a user performs some activity. If there are not proper restrictions set, an attacker can easily read and get hold of sensitive information.
