IDOR on HackerOne Embedded Submission Form 💰 💲
-
Steps to reproduce (obtaining inactive UUID of many private programs)

1- Use this command echo 'https://hackerone.com/' | waybackurls > lists.txt make sure you have waybackurls installed on your attackbox
2- cat lists.txt | grep "embedded_submissions" > results.txt
3- cat results.txt
4- You will find a lot of embedded submission id of many random private programs, you can check it by browsing each URL
-
https://lnkd.in/drCHC6qA
-
By @japzdivino
https://x.com/japzdivino

⚔️Pentest-Windows
🔰Windows11 Penetration Suite Toolkit

📌A Windows penetration testing environment that works out of the box.

⚠️This project was created for educational purposes and should not be used in environments without legal authorization.

🔗Link: https://lnkd.in/gtX3GbR8

🔖#infosec #cybersecurity #hacking #pentesting #security #infosec #cybersecurity #hacking #pentesting #security #oscp #ceh #nmap #infosec #hackingtools #networksecurity

📢You can now passively enumerate all endpoints of a website with katana. (No need waybackurls)

📝Example:

echo nasa.gov | katana -passive -f qurl -pss waybackarchive,commoncrawl,alienvault | tee endpoints

🚨You can then check the status of these endpoints or filter in order to find new vulnerabilities:

⚠Example:

echo nasa.gov | katana -passive -f qurl -pss waybackarchive,commoncrawl,alienvault | httpx -mc 200 | grep -E '\.(js|php)$' | tee specificEndpoints

💪🏻Scan for Adobe Commerce & Magento - XXE

(CVE-2024-34102) discovered by Sergey Temnikov using Nuclei Template @pdnuclei

🔍 Details: https://lnkd.in/dBy32DtY

📑 Nuclei Template: https://lnkd.in/dUNFMUny

🔧 GitHub PR: https://lnkd.in/dqu65C5i

#bugbounty #adobe #pdteam #infos

Advanced IDORs - 9 Techniques by Intigriti:

1. Exploiting Basic IDORs

How to: Modify a predictable numeric ID in the request URL or parameters.
Example: GET /user/email?userId=1002 (change userId to another value).

2. Exploiting IDORs via Parameter Pollution

How to: Inject multiple instances of the same parameter in the request.
Example: POST /update_profile with user_id=1234&user_id=5678.

3. Exploiting IDORs via JSON Globbing

How to: Manipulate JSON fields with arrays, booleans, wildcards, or large integers.
Example: { "user_id": ["1234", "5678"] } or { "user_id": "*" }.

4. Exploiting Method-Based IDORs

How to: Change the HTTP method to bypass access controls.
Example: Change GET /user/data to POST /user/data.

5. Exploiting Content-Type-Based IDORs

How to: Alter the Content-Type header to manipulate request processing.
Example: Use Content-Type: application/json instead of Content-Type: text/plain.

6. Exploiting IDORs via Deprecated API Versions

How to: Use older API versions that may lack updated security checks.
Example: Access /v1/user/data instead of /v2/user/data.

7. Exploiting IDORs in APIs that Use Static Keywords

How to: Replace keywords like current or me with numerical user IDs.
Example: Change /user/profile/current to /user/profile/1002.

8. Exploiting IDORs that Require Unpredictable IDs

How to: Find references to UUIDs or hashes in other parts of the application.
Example: Extract UUID from profile URLs like /profile/123e4567-e89b-12d3-a456-426614174000.

9. Exploiting Second-Order IDOR Vulnerabilities

How to: Manipulate stored IDs used in subsequent processes.
Example: Submit a form that stores your ID, then trigger an export process that retrieves data using that stored ID.
----------------------------------------------------------

I've never seen real-world examples for some of them, but they are definitely worth the try.

#pentesting #appsec #bugbounty #cybersecurity

Here's the full scoop: https://buff.ly/3zfhhzL

Who said pdf.js Cookie prompt doesn't works? 🤔

When hunting for IDORs during a bug bounty program, consider the following tip:

1. Leverage archive tools: Utilize tools like Wayback Machine or specialized software like Waymore to manually archive and analyze subdomains. This can help uncover hidden or previously accessible endpoints that may now be vulnerable to IDORs.

Example usage:
python3 waymore.py -i sub.target.com -mode U -xcc

2. Extract all paths with specific keywords: After identifying potential paths, extract all URLs containing specific keywords, such as "admin" or "manager," to narrow down your search.

Example command:
cat result.txt | grep "admin"

3. Fuzzing: If you find a suspicious path but it doesn't yield any results, try fuzzing the URL with a wordlist. This can help uncover hidden or unintended parameters.

Example usage:
ffuf -u https://sub.taget.com/promo/offer/1234/FUZZ -mc 200

4. Brute force: If you find a path with a dynamic ID, consider brute-forcing the last digits or numbers. This can help uncover additional sensitive information or functionality.

Example scenario:
Found path: https://sub.taget.com/promo/offer/1234/details

Brute-force the last 3 digits: 1234


By following these steps, you can uncover hidden or unintended IDORs, leading to potential security vulnerabilities and rewards in bug bounty programs.