leaky-paths

关于 一个收集了与主流Web框架和基础设施项目相关的特殊 路径的集合，包括已知的实用API、错误配置等。这些路径可用于Web内容发现，是快速获取成果的最快方式。 目标 为了向社区提供高质量的词列表，我开放了这个仓库，欢迎任何人贡献。这应该是你在任何目标上快速获取成果的首选，无论你是使用它进行评估的渗透测试人员，还是将其作为外部攻击面扫描一部分的安全工程师，或者是在扫描大量子域名/主机以使用高质量词列表快速获取成果的漏洞赏金猎人。它包含： 与已知错误配置、泄露敏感数据的端点、授予对应用某些特殊部分访问权限等相关的路径 。...

Design/Logic Flaw

Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials username + password compromised could potentially have the second-factor authentication...

Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, ha...

Law enforcement app SweepWizard leaks data on crime suspects

SweepWizard, an obscure app apparently created by ODIN Intelligence and used by more than 60 law enforcement departments, has a flaw: According to an ethical hacker, a misconfiguration in the app's API application programming interface caused it to unintentionally leak to the open internet a trov...

UPchieve: Zero click account Takeover due to Api misconfiguration 🏂🎩

Hacker reported that full account takeover was possible through exploitation of one our forms. Hacker provided sufficient information to prove capability and how to remediate. Our team remediated the issue so that the takeover is no longer possible. i was able to take over any account without any...

BCM Messenger: API - Amazon S3 bucket misconfiguration

Dear, BCM Messenger Description My discovering was starting from com.bcm.messenger, First, i trace what application send and receive from the network so i use Frida tool to bypass SSL pinning, Then i was able to trace application http traffic, and since API data is not encrypted and there's nothi...