Uber: Bruteforce INVITE codes easy way

As soon as i read the vulnerability disclosed on h1 regarding Possibility to brute force invite codes in riders.uber.com "https://hackerone.com/reports/125505" . I have found similar & easy way to bruteforce invite codes but in different manner . Also, 1680 public invites are waiting for...

Instacart: Authorization Bypass in Delivery Chat Logs

An authorization issue in the mobile app API allows any Instacart user to gain access to other users' order delivery chat logs. The /api/v2/orderdeliveries/:orderdeliveryid/orderchangelogs endpoint does not sufficiently check if the user has permissions to access that particular order's chat logs...

Firefox Security Toolkit - A Tool that Transforms Firefox Browsers into a Penetration Testing Suite

A tool that transforms Firefox Browsers into a penetration testing suite How? It downloads the most important extensions, and install it on your browser. The used extensions has been chosen by a survey among the information security community. Based on it's results, Firefox Security Toolkit was...

Firefox Security Toolkit

Firefox Security Toolkit will download the most important security extensions and add them all into your browser. All the extensions have been chosen by a survey among the information security community. Based on the results, the Firefox Security Toolkit was made. Also, the Firefox Security Toolk...

Veris: Unauthenticated CSRF(User can input any value for CSRF Token)

Hello Veris, I believe you have implemented CSRF token on the registration for a reason. In my research, I found that a user supplied CSRF Token would be accepted and even saved in the browser cookie and will be the set token on subsequent request. This report is limited to the Register and Login...

BurpSuiteJSBeautifier - Burp Suite JavaScript Beautifier

Most of the websites compress their resources such as JS files in order to increase the loading speed. However, security testing and debugging a compressed resource is not an easy task. This is a Burp Suite open source extension which makes it possible to beautify most of the resources properly...

New Relic: Privilege Escalation In Moniter

When one user create an account its data may not be accessible by other user. Links are only opened by a privilege user But What here happens is. I login from one account & copy a link, it will still accessible two other account with help of burp proxy by traffic stopping. Reproduce Steps :- 1...

CivicRM 4.7b3 SQL Injection

CivicRM extends common CMS platforms WordPress, Drupal with a module to manage Civic campaigns, tracking donors, amounts, and campaign CRM type activity. I tested the WordPress integration of CivicRM 4.7b3 which was found to have blind SQL Injections that allow authenticated users to download...

Snapchat: Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentials

Hey team, While doing some recon for Snapchat's domains, I came across a particular domain of interest - sc-corp.net. It seems that this domain hosts a lot of Snapchat's internal tools, web applications and staging environments such as Phabricator and other administration panels. From analyzing S...

Uber: Brute Force Amplification Attack

The websites on following hosts - newsroom.uber.com - eng.uber.com - brand.uber.com are vulnerable to Wordpress Brute Force Amplification Attack where an attacker can try a large number of Wordpress usernames and password login combinations in single HTTP request more at...

XSS Hunter – A Modern Approach to Testing for Cross-site Scripting (XSS)

Cross-site Scripting XSS origins go arguably back to a lab in Microsoft in 1999. With the first disclosure of the issue titled “ Malicious HTML Tags Embedded in Client Web Requests “, this research sparked an entire generation of an attack that somehow still seems to persist in modern web...

PHP local file inclusion vulnerability environment to build and use-vulnerability and early warning-the black bar safety net

0x00 description php local file inclusion vulnerability related to knowledge, the dark clouds on the earlier to have appropriate articles, lfi with phpinfo earliest by large foreign cattle raised, reference the following two articles. The use of the principle is to use the php post to upload file...

New Relic: Normal user can set "Job title" of other users by Direct Object Reference

A normal user when logs in to "New Relic" and navigates to the "Account Settings" page, can only set his/her own Job title. All other user's Job title selection are not available. But using a proxy tool like Burp Suite, while changing his own job role, if he replaces his own ID with any other use...

Veris: Missing Server Side Validation of CSRF Middleware Token in Change Password Request

Hello Team, I have found that CSRF Middleware Token is not getting validated at server side in CHANGE PASSWORD request. This request even works without csrfmiddlewaretoken. Steps to Reproduce: 1. Login to your Veris View Account. 2. Go to Settings. 3. Change your password. 4. Submit the form. 5...

Veris: Password(s) can be found via login process.

Hello security team, It is possible to find passwords of other users by enumerate the login process. The scenario is quiet simple: 1 Go to https://sandbox.veris.in/portal/login/ 2 Fill in 'Email ID' and 'Password' and click 'Log In' 3 Capture the request via burp suite and send it to intruder. 4...

New Relic: Reflected XSS on Signup Page

Hello Team, I have found a reflected XSS on Signup Page i.e. on https://newrelic.com/signup. Please find the below details. Vulnerable URL: https://newrelic.com/signup Vulnerable Field: Your Email Address Vulnerable Parameter: email Parameter Type: POST Payload used: Browser used: Mozilla Firefox...

Android Pentesting Portable Integrated Environment: Appie

Appie is a software package that has been pre-configured to function as an Android Pentesting Environment on any windows based machine without the need of a Virtual MachineVM or dualboot. It is completely portable and can be carried on USB stick or your smartphone. It is one of its kind Android...

ManageEngine Firewall Analyzer 8.5 - Multiple Vulnerabilities

Exploit for windows platform in category web applications ================================================================ ManageEngine Firewall Analyzer 8.5– Privilege Escalation Vulnerability ================================================================ Description : Vulnerability Type :...

ManageEngine Network Configuration Management Build 11000 - Privilege Escalation

ManageEngine Network Configuration Management Build 11000 - Privilege Escalation =================================================================================== Privilege escalation Vulnerability in ManageEngine Network Configuration Management...

ManageEngine Network Configuration Management Build 11000 - Privilege Escalation

Exploit for multiple platform in category web applications =================================================================================== Privilege escalation Vulnerability in ManageEngine Network Configuration Management...