XSS Payload Management Framework: Sleepy Puppy

Sleepy Puppy is a cross-site scripting XSS payload management framework which simplifies the ability to capture, manage, and track XSS propagation over long periods of time. Why Should I use Sleepy Puppy? Often when testing for client side injections HTML/JS/etc. security engineers are looking fo...

Burp Suite Tutorial

Ребята из bugcrowd начали записывать видео-руководство по использованию программы Burp Suite Видео ENG: Hacking with Burp Suite - Tutorial 1 Вопросы по курсу...

Web Security Dojo

Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. Virtualbox and VMware versions are available for download. Dojo is an open source project intended to be used as a training environment, and shouldn’t be used as a pen-testing platform due to the...

Slack: Link vulnerability leads to phishing attacks

Hello Guys, Hope you are doing great. I'm sending this email to let you know about a vulnerability i stumbled upon while using slack it's a great app!. While copy-pasting a link from a pdf to slack desktop/web, i noticed that the resulting links looked a bit messed up 1.png Firing up burp and...

BypassWAF - Burp Plugin to Bypass Some WAF Devices

Add headers to all Burp requests to bypass some WAF products. This extension will automatically add the following headers to all requests. X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 Usage Steps include: 1. Add extension to burp 2. Create...

Hishop商城分销系统某处信息泄露

简要描述： RT 详细说明： 前人案例： http://wooyun.org/bugs/wooyun-2010-019206 泄露地址： /SubmmitOrderHandler.aspx?Action=GetUserShippingAddress&ShippingId=2 其中ID值为可控的，用BURP不断遍历可以找出非常多的用户信息 案例： http://demo.kuaidiantong.cn/SubmmitOrderHandler.aspx?Action=GetUserShippingAddress&ShippingId=2...

Autorize - Automatic Authorization Enforcement Detection (Extension for Burp Suite)

Autorize is an automatic authorization enforcement detection extension for Burp Suite. It was written in Python by Barak Tawily, an application security expert at AppSec Labs. Autorize was designed to help security testers by performing automatic authorization tests. Installation 1. Download Burp...

A Year Later, XSS Vulnerability Still Exists in eBay

A potentially dangerous cross-site scripting XSS vulnerability has existed in eBay for more than a year, and it doesn’t appear the company is a rush to fix the issue. Jaanus Kääp, a researcher based in Estonia, discovered the issue more than a year ago when he was looking into the security of web...

Burp Suite Professional v1.6.16 - The Leading Toolkit for Web Application Security Testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security...

Shopify: Lack of SSL Pinning on POS Application ( iOS )

Description Given that this is a POS application and handle CHD, cryptographic security is of most importance. Applications such as Square, Amazons POS, etc. have already implemented this. The iOS application is correctly checking for SSL certs using the os keychain, but due to the lack of checki...

嘉挚科技短信通sql注入

简要描述： rt 详细说明： http://sms.finereason.com/ 首先注册一个用户，登陆。然后在 http://sms.finereason.com/member/ComSms.asp?tid=1 存在在注入。用burp抓包，然后保存。 GET /member/ComSms.asp?tid=1 HTTP/1.1 Host: sms.finereason.com Proxy-Connection: keep-alive Accept:...

Cool Dog PC client remote JS code injection vulnerability(impact of the National cool Dog the user can hung it)-vulnerability warning-the black bar safety net

Mainly using the three vulnerability completed 1 cool Dog Radio backgroundxssvulnerability 2 cool Dog Radio personal background override vulnerability 3 cool Dog Radio home storage-typexssvulnerability 一 :http://www.kugou.com/fm2/app/musicshow/admin/njadmin/index.php Cool Dog Radio personal...

ArcSight Logger - Arbitrary File Upload Code Execution

ArcSight Logger - Arbitrary File Upload Code Execution Exploit Title: ArcSight Logger - Arbitrary File Upload Code Execution Date: 13.03.2015 Exploit Author: Julian Horoszkiewicz Vendor Homepage: www.hp.com Software Link:...

Doyo建站最新版本存在CSRF添加管理员漏洞

简要描述： Doyo建站最新版本存在CSRF添加管理员漏洞 详细说明： 在后台添加管理员打开burp抓下包看看是怎么样的带入数据库的 None 漏洞证明：...

Vimeo: A user can enhance their videos with paid tracks without buying the track

It is possible to enhance videos with paid tracks without buying the track. Steps to verify: 1. Log into vimeo.com and navigate to https://vimeo.com/enhancer. 2. Click on any paid music track and note down the track id from the URL ex:...

phpmywind最新5.2版本存在CSRF添加管理员漏洞

简要描述： phpmywind最新5.2版本存在CSRF添加管理员漏洞 详细说明： 嗯哼？ 在后台添加管理员时候开启burp截取下包 看看是怎么样的。 None...

Vimeo: A user can post comments on other user's private videos

It is possible for a user to post comments on other's private videos. Steps to verify: 1. Log into www.vimeo.com as Alice and create a video say, AliceVideo with id - 118026546 with 'Allow anyone to see my videos' setting. 2. Login as Bob and create an album say, BobAlbum with album id 3295969. 3...

Vimeo: A user can edit comments even after video comments are disabled

A user can escalate privileges and edit his previous comments, when comments are disabled for a video. Steps to verify: 1. Log into vimeo.com as Alice. Upload a video say, video id - 118026546 and allow anyone to leave comments for that video . 2. Login as Bob and navigate to the video URL -...

Yelp: Information disclosure - emails disclosed in response > staging.seatme.us

Hello, I found a info disclosure vulnerability. We can enumerate emails via userid parameter from Manage users. And I found that : ID 1 is ██████ ID 514755 is ████████ ID 514775 is █████ ID 514764 is ███████ I attached photos from burp repeater to be more explicit. We can easily bruteforce userid...

HackerOne: Restrict any user from logging into his account.

Hackerone's destroys user sessions automatically after signing out,changing password etc.So Old sessions are seems to be worthless for any attacker.But I found something,by exploiting this you can restrict any hackerone user to logging into his account. Pre-Requisition I just need one of his old...