Discover and read the best of Twitter Threads about #bugbountytips

Most recents (24)

#learn365 Day-31: Captcha Bypass Techniques

Captcha is widely adapted by the applications to avoid automated attempts on specific functionality, commonly on the Authentication forms to avoid brute-force attacks.

#bugbountytips #appsec #infosec #Pentesting

(1/n)
(2/n)
However, it is possible to bypass Captcha, and sometimes if the function is critical, it can be paid well in terms of bounties.

1. Missing Server-Sides Validation
- Some apps send Captcha Parameters on the client-side but they do not validate this on the server side.
(3/n)
- Simply, Remove the "Captcha" parameters and see if the request is processed successfully.
- If yes, you can now use this request to perform your brute-force or rate-limiting attempts.
Read 10 tweets
#learn365 Day-30: Common Business Logic Issues (Wrap)

(Cont'd...)
9. Parameter Tampering
- Tamper Payment or Critical Fields to manipulate their values
- Add multiple fields or unexpected fields by abusing HTTP Parameter Pollution & Mass Assignment
#bugbountytips #appsec
(1/n)
(2/n)
- Response Manipulation to bypass certain restrictions such as 2FA Bypass

10. App Implementation Logic Abuse
- If an app accepts JSON data, try changing content type to XML and see if the XML data is being processed, it can be left vulnerable to XXE or XML-based attacks.
(3/n)
- If an application is using the DELETE method to delete a resource but there is no CSRF protection, try converting the method to GET/POST and add an additional parameter like ?method=delete
Read 7 tweets
#learn365 Day-29: Common Business Logic Issues (Part - 2)

(cont'd...)
5. Premium Feature Abuse
- Try forcefully browsing the areas or some particular endpoints which come under premium accounts.

#bugbountytips #AppSec #infosec #pentest

(1/n)
(2/n)
- Pay for a premium feature and cancel your subscription. If you get a refund but the feature is still usable, it's a monetary impact issue.
- Some applications use true-false request/response values to validate if a user is having access to premium features or not.
(3/n)
- Try using Burp's Match & Replace to see if you can replace these values whenever you browse the app & access the premium features.
- Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not.
Read 8 tweets
#learn365 Common Business Logic Issues: Part-1

I'll try to cover some of the interesting business logic flaws that I usually test and have encountered so far today & in the next couple of days. Feel free to add more if you know any.
#bugbountytips #appsec #websecurity

(1/n)
(2/n)

1. Review Functionality
- Some applications have an option where verified reviews are marked with some tick or it's mentioned. Try to see if you can post a review as a Verified Reviewer without purchasing that product.
(3/n)
- Some app provides you with an option to provide a rating on a scale of 1 to 5, try to go beyond/below the scale-like provide 0 or 6 or -ve.
- Try to see if the same user can post multiple ratings for a product. This is an interesting endpoint to check for Race Conditions.
Read 9 tweets
#learn365 Day-22: Password Reset Token Issues

1. Weak Cryptography in Password Reset Tokens
- Always check randomness in password reset tokens. It is also a good idea to check password reset tokens against known schemes.
Ref: medium.com/bugbountywrite…
#bugbountytips
(1/n)
(2/n)
2. Reusable Password Reset Tokens
- Use the token once and try to re-use it again.
- Request a new token and try if the old one is still active.
- Check how long a token stays alive. If it's >1 day and is reusable, you may report it.
(3/n)
3. IDOR (ATO)
- In the password reset link, assume there is something like this:
harshbothra.tech/reset?token=so…
- try changing the value of the user parameter to the victim and see If the attack token can be used for resetting the victim's password.
harshbothra.tech/reset?token=so…
Read 8 tweets
#learn365 Day-21: GraphQL Vulnerabilities (Part-2)
1. Information Disclosure via Error Messages
- Similar to the normal information disclosure via error triggering.
- Provide malformed or unexpected input within GraphQL queries.

#BugBountyTips #appsec #infosecurity

(1/n)
(2/n)
- Sometimes you may observe verbose error messages revealing sensitive information.

2. GraphQL Denial of Service
- Due to an improper limit on the maximum query depth, it might be possible to perform a denial of service in graphql implementation.
(3/n)
- Nest a query to unlimited depth and send this query on a GraphQL endpoint to observe anything suspicious.
- A good example: owasp-skf.gitbook.io/asvs-write-ups…

3. Insecure Direct Object Reference
- Similar to normal API like IDORs
- A good example: owasp-skf.gitbook.io/asvs-write-ups…
Read 4 tweets
#learn365 Day-20: GraphQL Series Part - 1
- GraphQL is a query language for the underlying API.
- A single endpoint can be used as a query API to perform all the actions including Create, Read, Update & Delete.

#bugbountytips #appsec #infosec

(1/n)
(2/n)
- GraphQL has its own type of system that’s used to define the schema of an API. The syntax for writing schemas is called Schema Definition Language (SDL).

# A GraphQL operation can be of type:
1. query (a read-only fetch)
2. mutation (a write followed by fetch)
(3/n)
3. subscription (a long‐lived request that fetches data in response to source events.)
- A GraphQL document can contain one or more of these operations (i.e multiple queries/mutations/subscriptions).
- Mutations queries modify data in the data store and returns a value.
Read 9 tweets
#learn365 Day-13: WebSocket Vulns (Intro)

WebSocket is a network protocol that enables 2-way communication b/w client & server. In the HTTP standard, where the one-party has to wait for the req./res from another party before performing the next action.

#bugbountytips
(1/n)
(2/n)
The major goal of WebSocket is to enable real-time communication and can widely be seen in IM applications.

I will be diving the WebSocket learning into 3 parts and I will post more about various attacks in the next two days.
(3/n)

# Web socket Protocol Scheme

1. Websockets use wss:// and ws:// as the protocol scheme.
2. This is similar to HTTPS and HTTP. Here, the WSS:// is a secure channel where WS:// is an insecure channel.
Read 7 tweets
#learn365 Day-12: Unicode Normalization
This attack is hard to explain w/o proper graphics. Please refer to the references mentioned for a detailed explanation. This is a really good attack vector to try and consider while doing PT/BB.
(1/n)
#bugbountytips #AppSec #infosec
(2/n)
Unicode to ASCII Transformation is a two-step process.

1. Normalization: Where the characters are converted to a standardized form
2. Punycoding: Where the Unicode is turned into ASCII

There are two overall types of equivalence between characters:......
(3/n)
1. Canonical Equivalence: Characters are assumed to have the same appearance and meaning when printed or displayed.

2. Compatibility Equivalence: This is a weaker equivalence, in that two values may represent the same abstract character but can be displayed differently.
Read 6 tweets
#Learn365 Day-11: Cache Poisoned Denial of Service (CPDos)
AIO Resource: cpdos.org
- One of a kind of Web Cache Poisoning attack that affects the resources used by an application to create a denial of service situation.

#bugbountytips #AppSec #infosec

(1/n)
(2/n)
# Working

The working of this attack is theoretically very simple to understand:

1. The attacker sends a request to the server containing a malicious header with a malicious value. This can be any random header.
ex: x-mal-example: tohackthehacker
(3/n)
2. This request is first processed by the intermediate cache server to check if the copy exists.
3. The cache server forwards the attacker's request with malicious headers to the origin server as it doesn't store a fresh copy of the requested resource.
Read 16 tweets
#learn365 Day-7: Cross-Site Script Inclusion (XSSI)
- XSS & XSSI are differemt.
In XSS, the payload is included on the victim to perform an action. However, In the case of XSSI, the victim's code (JS) is embedded in the attacker-controlled page.

#BugBountyTips #infosec (1/n)
(2/n)
In XSSI, the goal is to usually steal the data bypassing the restrictions such as the Same Origin Policy (SOP).
XSSI is less utilized and I never paid much attention to this attack vector. This seems to be an interesting and realistic, easy to exploit attack vector.
(3/n)
This attack is to mainly target the sensitive information that might get dynamically stored in the javascript files when a user performs some activity. If there are not proper restrictions set, an attacker can easily read and get hold of sensitive information.
Read 10 tweets
#Learn365 Day-6: Cross-Site Leaks

Goldmine to Learn: xsleaks.com

Cross-Site Leaks/XS-Leaks is a less explored security issue that usually comes from Side-Channel Attacks. I found this an interesting vector but unusual.

(1/n)

#BugBountyTips #infosec #AppSec
(2/n)
This basically utilizes the web's core principle of composability in order to determine & extract useful information.

XS-Leaks take advantage of small pieces of information that are exposed during interactions between websites.
(3/n)
Cross-Site Oracle.

This can be considered as a querying mechanism. The information used for this attack is of binary form and called Oracles. It usually has an answer of "Yes" or "No". You can say True or False.
Read 11 tweets
#Learn365 Day-5: Client-Side Template Injection (CSTI)
1. This occurs at the client-side like other JS attacks such as XSS.
2. This is mainly seen in the various JS libraries like AngularJS, VueJS etc which utilize the template engines at the client-side.
(1/n)
#bugbountytips
(2/n)
3. The presence of "ng-app" in the page source identifies the use of templates.
4. If the application directly accepts the input and process it without any validation, it may be vulnerable to CSTI.
5. CSTI leads to perform cross-site scripting attacks by escaping...
(3/n)
6. Testing this issue is similar to Server-Side Template Injection.
7. Steps:
a. In the suspected field, provide a payload like {{11*5}}
b. If the response reflected is 55, this tells that there is the use of the template and further you can try performing CSTI to XSS
Read 4 tweets
#Learn365 Day-4: Unauthenticated & Exploitable JIRA Vulnerabilities

There are multiple security vulnerabilities associated with the various versions of JIRA software which are exploited in wild and is one of my personal favourite 3rd Party apps to hunt.

#BugBountyTips

(1/n)
(2/n)
1. CVE-2020-14179 (Information Disclosure)
a. Navigate to <JIRA_URL>/secure/QueryComponent!Default.jspa
b. It leaks information about custom fields, custom SLA, etc.

2. CVE-2020-14181 (User Enumeration)
a. Navigate to <JIRA_URL>/secure/ViewUserHover.jspa?username=<uname>
(3/n)
3. CVE-2020-14178 (Project Key Enumeration)
a. Navigate to <JIRA_URL>/browse.<project_key>
b. Observe the error message on valid vs. invalid project key. Apart from the Enumeration, you can often get unauthenticated access to the project if the protections are not in place.
Read 9 tweets
#learn365 Day-3 SAML Vulns
SAML (Security Assertion Markup Language) is widely used for authentication. It uses XML schema and is prone to multiple security vulnerabilities. Some of the common security issues are:

1. XML Signature Wrapping (XSW) Attacks:
(1/n) #bugbountytips
(2/n)
.. XSW Attacks happen when the XML Digital Signature (XML DSig) is not validated which is used to establish a trust b/w IDPs & Service Providers.
This attack can lead to situations like Privilege Escalation, Authentication Abuse & Denial of Service as well.
(3/n)
Good Resource on SAML Signature Attacks: research.aurainfosec.io/bypassing-saml…
Burp Extensions: SAML Raider
There are multiple variants of XSW attacks from XSW1 to XSW8 (Way of exploitation varies a bit). You can read more about them here in little details: github.com/swisskyrepo/Pa…
Read 8 tweets
#learn365 Day-2: Regular Expression Denial of Service (ReDoS)
Due to weakly implemented RegEx Sometimes it is possible to perform a DoS attack by making this expression to evaluate an expression which will make the application work relatively slow. (1/n)

#bugbountytips
(2/n) Usually, this attack is explored and exploited when the source code is available and you can figure out what regular expressions are used in the code at what fields. For example, at the mobile no input field, what is the regex that validates the mobile no input field.
(3/n) However, you can also try to find this in Black/Gray Box engagements.

Method: Open the JavaScript files and search for the "RegExp(" function and try to figure out what function utilize that particular Regex.
Evaluation: github.com/2bdenny/ReScue This is a good tool...
Read 6 tweets
#learn365 Day-1: 2FA Bypass Techniques
1. Response Manipulation - In response if "success":false, change it to "success":true
2. Status Code Manipulation - If Status Code is 4xx, try to change it to 200 OK and see if it bypass restrictions.

(1/n)
#bugbountytips
(2/n)
3. 2FA Code Leakage in Response: Check the response of the 2FA Code Triggering Request to see if the code is leaked.
4. JS File Analysis: Rare but some JS Files may contain info about the 2FA Code, worth giving a shot.
5. 2FA Code Reusability: Same code can be reused.
(3/n)
6. Lack of Brute-Force Protection: Possible to brute-force any length 2FA Code.
7. Missing 2FA Code Integrity Validation: Code for any user acc can be used to bypass the 2FA
8. CSRF on 2FA Disabling: No CSRF Protection on disabling 2FA, also there is no auth confirmation.
Read 6 tweets
#bugbountytips
An almost universal way to theft or overwrite arbitrary files on #android is sharing activities. You can find them in AndroidManifest.xml. They handle android.intent.action.SEND. Use the PoC from blog.oversecured.com/Evernote-Unive… (ctrl+f "EXTRA_STREAM") and test 4 scenarios:
1. Send a Uri to an internal file using file:// scheme (direct or using a symlink)
2. Send a Uri to an internal file using a victim app's internal content provider
now grep private file contents on SD card
3. Send a Uri to your own file like explained in the article above (test _display_name and last path segment values to be vulnerable to path-traversal)
now run "ls -la dir | grep file_name" on /sdcard and /data/data/app

and also read hackerone.com/reports/288955, love that technique
Read 4 tweets
#jira #bug #bugbountytips 1 )jira bug test parameter
"/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)"
"/secure/admin/user/DeleteUser!default.jspa?name=a"><script>alert(document.cookie);</script>&returnUrl=UserBrowser.jspa
2) ""/plugins/servlet/oauth/users/icon-uri?consumerUri=ipinfo.io/json"
"/plugins/servlet/gadgets/makeRequest?url=jira.tools..com:1337@example.com"
/ViewUserHover.jspa?username=Admin
3)/secure/QueryComponent!Default.jspa
/plugins/servlet/Wallboard/?dashboardId=10100&dashboardId=10101&cyclePeriod=(function(){alert(document.cookie);return%2030000;})()&transitionFx=none&random=true
Read 8 tweets
📢#infosec AMA #13

Our next guest is :-

❤️ Ai Ho aka @j3ssiejjj ❤️

Passionate security engineer, Creator of Osmedeus and Jaeles, CTO & Co-founder of @HunterSuite

RT & ask questions for those #bugbountytips and chance to win a voucher sponsored by @PentesterLab

Till 18th Image
Could you please tell us about @HunterSuite ?
Read 3 tweets
What I extracted from Jason Haddix video in Bugcrowd University - Broken Access Control

✅Create 2 accounts, logout, login the first account and try requests with the second GUID.
✅search for other endpoints or web services that might leak other UIDs)

#bugbountytips 1/6
✅Page uses a function to render/include a page, so we can use a arbitrary path to get content from the server.
GET /view?pg=termandservices
GET /view?pg=../../../../../etc/passwd%00
✅GET /admin/viewtransactions - ACCESS DENIED
GET /ADMIN/viewtransactions - ACCESS GRANTED

2/6
✅GET /patientImages/3216647.jpg
GET /patientDocuments/1235.pdf
✅Many times the pages functions are not access controlled, which means we can change the parameters
POST /admin/viewTransactions.ashx?admin=true&from=08032017&to=08032018
(ex: change the price parameter)
3/6
Read 6 tweets
Burp Extensions that I use: (1/n)

1. Autorize - To Test BACs
2. Burp Bounty - Profile-based Scanner
3. Active Scan++ - Add more power to Burp's Active Scanner
4. AuthMatrix - Authorization/PrivEsc Checks
5. Broken Link Hijacking - For BLH

#bugbountytips #bugbounty
(2/n)
6. Collaborator Everywhere - Pingback/SSRF
7. Command Injection Attacker
8. Content-Type Converter - Trying to bypass certain restrictions by changing Content-Type
9. Decoder Improved - More Decoder Features
10. Freddy - Deserialization
11. Flow - Better HTTP History
(3/n)
12. Hackvertor - Handy type conversion
13. HTTP Request Smuggler
14. Hunt - Potential Vuln Identifier
15. InQL - GraphQL Introspection testing
16. J2EE Scan - Scanning J2EE Apps
17. JSON/JS Beautifier
18. JSON Web Token Attacker
19. ParamMiner - Mine Hidden Parameters
Read 5 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!