Thread by @Steiner254

Day 0⃣5⃣/2⃣0⃣ -- [Web Application Profile/Dashboard Hacking]
➡️ Day 5, Profile Update/Dashboard Vulnerabilities & References.
➡️ Below are Tips & References (Feel Free To Share)🧵🧵👇👇
#BugBounty
#bugbountytips
#cybersecuritytips

1/n
IDOR on the dashboard

2/n
Instagram IDOR

3/n
OS Command Injection

4/n
Stored XSS on profile dashboard POC

5/n
Stored XSS Filter bypass on dashboard

6/n
Remote Command Execution(RCE) Vulnerability PoC

7/n
CSRF while adding an Address Book

8/n
Hot to test for CSRF

9/n
Change Email & Password CSRF

10/n
CSRF while adding a payment method

11/n
PayPal CSRF that leads to adding a donate button

12/n
Application Layer DDOS while adding an Address/Manage Address Book

13/n
RCE via File Upload in MartDevelopers-Inc/KEA-Hotel-ERP

14/n
Tesla Lack Of Password/Authentication When Disabling 2FA.

15/n
Email Change Confirmation Bypass

16/n
EXIF Geolocation Data Not Stripped From Uploaded Images
medium.com/@souravnewatia…

n/n
Practice Makes Perfect!
Happy Hacking :)
See you here same time tomorrow!