Lucene search

K
huntrMaakthon5F3BC4B6-1D53-46B7-A23D-70F5FAAF0C76
HistoryAug 29, 2022 - 9:45 p.m.

No rate limit via proxy url parameter

2022-08-2921:45:08
maakthon
www.huntr.dev
14
proxy server
rate limit
request limit
potential attack
port scanning
owasp zap
bug bounty

EPSS

0.001

Percentile

37.9%

Description

Hi Drawio Team ,

Your proxy server has no limit of requests which an attacker can use it as PORT SCANNER.

https://app.diagrams.net/proxy?url={IP:PORT}&base64=1

Proof of Concept

Image from my OWASP ZAP : https://ibb.co/h87hz3N

EPSS

0.001

Percentile

37.9%

Related for 5F3BC4B6-1D53-46B7-A23D-70F5FAAF0C76