Thread by @silentgh00st

🧵NEW Thread🧵

Here is how I found the easiest SQLi and possible RCE in less than 30 min of recon and dorking

1. I was invited to a private program at @Hacker0x01 and the first thing I usually do is to look at the scope and see if it is a wildcard domain or just a small scope.

2. Found that the program accepts all vulnerabilities related to their assets and of course third party assets are OOS

3. I used @leak_ix search engine at leakix.net and used this dork [+target_name ++plugin:"GitConfigHttpPlugin"]
Note : this is used to search for already scanned websites that have /.git exposed

4. I visited the website and the /.git repository was downloadable and I dumped the source code using gitdumper.sh (you can find it at Github)

5. This was not the way I found the SQLi but when i visited the homepage there was a simple login page with username and password fields

6. I tried admin:admin to see if I could easily login as admin but no luck, but then I fired the burp and intercepted the login request and I injected a simple quote inside the username's field which was admin_username

7. I noticed that the app returned a different response code and I sent the request to Sqlmap tool to see what would happen

8. Using sqlmap with both params --risk 5 --level 3 --random-agent , the tool easily found that the field is vulnerable to time-based SQLi

9. I reported the finding immediately after listing the databases, and I tried to escalate it to RCE

10. I verified to see if the user is a DBA and have FILE privileges using sqlmap by adding this param --is-dba and the result was true, which means the user could write files to the server

11. Unfortunately, I was not able to escalate it since I could not know where the file is written exactly inside the server, but the H1 team were able to escalate it, but they updated the severity to CRITICAL😁 even if i was not able to escalate it myself 🤷‍♂️

12. That's it for this finding, the idea here is to use different search engines for recon and don't rely only on known ones like shodan zoomeye ...
Always verify the username field for SQLi and try different tools for testings (sqlmap, ghauri...)
#bugbountytips #bugbountytip

I was paid $2000 for this finding which is the maximum payout in this program.

#hackerone #BugBounty