Thread by @Mawg0ud

Another new idea for #PenetrationTesting and #Bug-hunting:

Tester:
Enhance the force of #vulnerabilities by doing things like
I discovered a free #URL that leads somewhere else.
Put this in my report and move on ?

To the contrary, changing the #payload allowed me to transform it into a reflected #XSS #vulnerability. Is this the final question?
Obviously not if I have any hope of carrying on.

This web app used #JWT tokens that were transmitted in the bearer header, and for some reason, there were three more cookies that also contained this token.
Only two of them were secure with #HTTP Only.
Just a wild guess.

That #cookie held the #JWT token of a superuser, and I was able to secretly send it to another server.
Thanks to the #CSRF or #URL masking, I have a great example to share with the customer. An attacker gets 30 minutes to unleash mayhem before the #token is no longer valid.

For instance, you might delete your user #database or make a new administrator. Both the application's #security and #privacy have been breached.
Especially if they store something of such value, developers should disable any legacy #cookies that may no longer be used.