Tweet

More from @harshbothra_

Harsh Bothra

@harshbothra_

22 Jan

#learn365 Day-22: GraphQL Part - 3 WrapUp

Pentesting GraphQL may look hard if you are not familiar but there is still a lot to explore and exploit once you understand how it works. Today, It's all about continue reading and some good resources.

#bugbountytips #appsec

(1/n)

(2/n)
# Resources
- security-simplified.com/blog/NDY/graph…
-
- pentestpartners.com/security-blog/…
- threatninja.net/tutorial-on-gr…
- labs.bishopfox.com/tech-blog/desi…
- hackerone.com/reports/885539
- hackerone.com/reports/645299
- hackerone.com/reports/419883
- hackerone.com/reports/614355
- hackerone.com/reports/633001

(3/n)
- hackerone.com/reports/489146
- hackerone.com/reports/608656
- hackerone.com/reports/423388
- hackerone.com/reports/707433
- hackerone.com/reports/417170
- hackerone.com/reports/800231
- hackerone.com/reports/924914
- hackerone.com/reports/898528
- hackerone.com/reports/978143
- hackerone.com/reports/715192

Read 4 tweets

Harsh Bothra

@harshbothra_

20 Jan

#learn365 Day-20: GraphQL Series Part - 1
- GraphQL is a query language for the underlying API.
- A single endpoint can be used as a query API to perform all the actions including Create, Read, Update & Delete.

#bugbountytips #appsec #infosec

(1/n)

(2/n)
- GraphQL has its own type of system that’s used to define the schema of an API. The syntax for writing schemas is called Schema Definition Language (SDL).

# A GraphQL operation can be of type:
1. query (a read-only fetch)
2. mutation (a write followed by fetch)

(3/n)
3. subscription (a long‐lived request that fetches data in response to source events.)
- A GraphQL document can contain one or more of these operations (i.e multiple queries/mutations/subscriptions).
- Mutations queries modify data in the data store and returns a value.

Read 9 tweets

Harsh Bothra

@harshbothra_

13 Jan

#learn365 Day-13: WebSocket Vulns (Intro)

WebSocket is a network protocol that enables 2-way communication b/w client & server. In the HTTP standard, where the one-party has to wait for the req./res from another party before performing the next action.

#bugbountytips
(1/n)

(2/n)
The major goal of WebSocket is to enable real-time communication and can widely be seen in IM applications.

I will be diving the WebSocket learning into 3 parts and I will post more about various attacks in the next two days.

(3/n)

# Web socket Protocol Scheme

1. Websockets use wss:// and ws:// as the protocol scheme.
2. This is similar to HTTPS and HTTP. Here, the WSS:// is a secure channel where WS:// is an insecure channel.

Read 7 tweets

Harsh Bothra

@harshbothra_

12 Jan

#learn365 Day-12: Unicode Normalization
This attack is hard to explain w/o proper graphics. Please refer to the references mentioned for a detailed explanation. This is a really good attack vector to try and consider while doing PT/BB.
(1/n)
#bugbountytips #AppSec #infosec

(2/n)
Unicode to ASCII Transformation is a two-step process.

1. Normalization: Where the characters are converted to a standardized form
2. Punycoding: Where the Unicode is turned into ASCII

There are two overall types of equivalence between characters:......

(3/n)
1. Canonical Equivalence: Characters are assumed to have the same appearance and meaning when printed or displayed.

2. Compatibility Equivalence: This is a weaker equivalence, in that two values may represent the same abstract character but can be displayed differently.

Read 6 tweets

Harsh Bothra

@harshbothra_

11 Jan

#Learn365 Day-11: Cache Poisoned Denial of Service (CPDos)
AIO Resource: cpdos.org
- One of a kind of Web Cache Poisoning attack that affects the resources used by an application to create a denial of service situation.

#bugbountytips #AppSec #infosec

(1/n)

(2/n)
# Working

The working of this attack is theoretically very simple to understand:

1. The attacker sends a request to the server containing a malicious header with a malicious value. This can be any random header.
ex: x-mal-example: tohackthehacker

(3/n)
2. This request is first processed by the intermediate cache server to check if the copy exists.
3. The cache server forwards the attacker's request with malicious headers to the origin server as it doesn't store a fresh copy of the requested resource.

Read 16 tweets

Harsh Bothra

@harshbothra_

9 Jan

#Learn365 Day - 8: JSONP Attack
(Deleted prev. post and re-sharing as there are some modifications & to avoid false statement)
JSONP stands for JavaScript Object Notation with Padding which allows sending JSON data across domains without worrying about Cross-Domain Issues. (1/n)

(2/n)
It utilizes <script> tag to perform the action instead of using XHR. However, the function requires to be existing in the global scope.
It is an insecure communication method & should be used when no personal/sensitive data is involved & sanitizing the callback function.

(3/n)There are multiple attacks affecting the JSONP implementation as it doesn't have a security feature.
The “padding” or function to call with the JSON data, is often specified as a parameter. Often this parameter is called callback and is reflected as-is in the response.

Read 8 tweets

Share this page!

Harsh Bothra

Try unrolling a thread yourself!

More from @harshbothra_

Harsh Bothra

Harsh Bothra

Harsh Bothra

Harsh Bothra

Harsh Bothra

Harsh Bothra

Did Thread Reader help you today?

Like this author's thread?