https://www.sonarsource.com/blog/why-code-security-matters-even-in-hardened-environments/

how to turn a file write vulnerability in a Node.js application into RCE – even though the target's file system is read-only

Bookmark this website they always release good stuff

How would I exploit arbitrary file write into RCE on modern frameworks like Node js, Flask, Django ?

By overwriting existing templates with template injection payloads. ⭐

𝐗𝐒𝐒 𝐢𝐧 𝐏𝐡𝐨𝐧𝐞 𝐍𝐮𝐦𝐛𝐞𝐫 𝐅𝐢𝐞𝐥𝐝 ? 👇

Recently I re-watched the NahamCon2022EU: RTFR (Read The Bleeping RFC) by securinti

One thing I was surprised to find out was that phone number fields can be vulnerable to XSS.

How is that possible?

According to the RFC it is possible to append "optional parameter" to the number. Something like:

 • 10203040;𝐞𝐱𝐭=+22
 • 10203040;𝐢𝐬𝐮𝐛=12345
 • 10203040;𝐩𝐡𝐨𝐧𝐞-𝐜𝐨𝐧𝐭𝐞𝐱𝐭=𝐞𝐱𝐚𝐦𝐩𝐥𝐞

This can lead to XSS if:

1. The library parses phone numbers according to RFC and accepts optional parameters such as "phone-context"

2. The phone number is reflected on the web interface without input validation or output encoding

So payloads like "10203040;𝐩𝐡𝐨𝐧𝐞-𝐜𝐨𝐧𝐭𝐞𝐱𝐭=<𝐬𝐜𝐫𝐢𝐩𝐭>𝐚𝐥𝐞𝐫𝐭(1)</𝐬𝐜𝐫𝐢𝐩𝐭>" CAN be a valid phone number and trigger XSS

https://github.com/tomnomnom/gron

This is one of the best tools for dealing with large JSON data. It makes it easier to query complex JSON and turn it into different formats

I use it always to test web api that sends or receives big json blobs to understand what it's actually doing

Free TryHackMe Access
If you’re unable to purchase a personal voucher, you can use the following account for learning purposes:

TryHackMe Premium Account
Email: elmsi.youssef@gmail.com
Password: pasderemarque@123

Please use the account responsibly—do not change or delete any settings or information.

First Review

XSS from javanoscript hidden params

assetfinder *.com | gau | egrep -v '(.css|.noscript)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars"

- Register An account with email service@intl.paypal.com on the target
- navigate to support section and see if there are any emails converted into support tickets

credit - NinadMishra
#bugbountytips

Offsec has been acquired by an private equity.
https://www.prnewswire.com/news-releases/leeds-equity-partners-acquires-offsec-302275836.html

🧑‍💻CloakQuest3r - Uncover the true IP address of websites safeguarded by Cloudflare & Others

https://github.com/spyboy-productions/CloakQuest3r