h1-ctf: [H1-2006 2020] Writeup

^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Prologue The CTF was announced in a Hacker0x01 tweet. The goal is to make payments from Marten Mickos' account on BountyPayHQ. The announcement tweet was followed shortly by a retweet of BountypayHQ, an account made for the event. BountypayHQ has one...

h1-ctf: h1-ctf writeup , finally paid the payments by chaining multiple bugs

Summary: Ultimate aim is to pay the payments of hackerone using bounty pay with no use privileges at starting. Given scope is : .bountypay.h1ctf.com Enumerated subdomains are : 1. www.bountypay.h1ctf.com 2. app.bountypay.h1ctf.com 3. staff.bountypay.h1ctf.com 4. api.bountypay.h1ctf.com 5...

h1-ctf: [H1-2006 2020] CTF writeup

Context Well, against all expectations you finally get it, you got the flag! Let's go back in time to remember how. --- Twitter Once upon a time As always the CTF starts with a tweet: F855948 --- Subdomains According to the policy page, .bountypay.h1ctf.com is in scope. You decide to scan...

Git-Scanner - A Tool For Bug Hunting Or Pentesting For Targeting Websites That Have Open .git Repositories Available In Public

This tool can scan websites with open .git repositories for Bug Hunting/ Pentesting Purposes and can dump the content of the .git repositories from webservers that found from the scanning method. This tool works with the provided Single target or Mass Target from a file list. Installation - git...

FreeBSD : malicious URLs may present credentials to wrong server (ced2d47e-8469-11ea-a283-b42e99a1b9c3)

git security advisory reports : Git uses external 'credential helper' programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially crafted URLs that contain an encoded newline can inject unintended values into the credential helper...

FreeBSD : malicious URLs can cause git to send a stored credential to wrong server (67765237-8470-11ea-a283-b42e99a1b9c3)

git security advisory reports : Git uses external 'credential helper' programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially crafted URLs that are considered illegal as of the recently published Git versions can cause Git to...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2020-1598)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

h1-ctf: [H1-2006 2020] The Story of Making Bounty Hunters Happy

Disclaimer: I will try to make this post a fun read, given that whoever triagges will be probably going through similar write-ups again and again. The beginning: Being away from HackerOne over a month had made me rusty. Although the call to arms for Mr. Mickos and the community could not be left...

h1-ctf: [H1-2006 2020] CTF Writeup!

The Beginning ===================== The scope of the H1-2006 CTF was .bountypay.h1ctf.com. After opening https://bountypay.h1ctf.com, I noticed that on the top left of the screen there was a dropdown with two login pages: one for Customers https://app.bountypay.h1ctf.com/ and one for Staff...

EulerOS 2.0 SP5 : git (EulerOS-SA-2020-1598)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This...

CentOS: Security Advisory for emacs-git (CESA-2020:2337)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CentOS 7 : git (RHSA-2020:2337)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2337 advisory. - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is...

emacs, git, gitk, gitweb, perl security update

CentOS Errata and Security Advisory CESA-2020:2337 An update for git is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

snyk-broker information disclosure vulnerability (CNVD-2020-54144)

snyk-broker is a proxy program for access between snyk.io and Git repositories. A security vulnerability exists in snyk-broker version 4.72.0 and later fixed in version 4.73.1. An attacker can exploit the vulnerability to read arbitrary files...

Scientific Linux Security Update : git on SL7.x x86_64 (20200529)

Security Fixes : - git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak CVE-2020-11008 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid136991; scriptversion"1.3";...

pcapplusplus:FuzzTarget: Bad-cast to pcpp::IDnsResource from invalid vptr in pcpp::DnsLayer::~DnsLayer

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5187603245826048 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000263260...

git security update

1.8.3.1-23 - Prevent crafted URL containing new lines, empty host or lacks a scheme to cause credential leak. Resolves: CVE-2020-11008...

Oracle Linux 7 : git (ELSA-2020-2337)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-2337 advisory. 1.8.3.1-23 - Prevent crafted URL containing new lines, empty host or lacks a scheme to cause credential leak. Resolves: CVE-2020-11008 Tenable has extracted the...

Important: Red Hat Security Advisory: git security update

An update for git is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Node.js third-party modules: [commit-msg] RCE via insecure command formatting

I would like to report a RCE issue in the commit-msg module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: commit-msg version: 0.2.3 npm page: https://www.npmjs.com/package/commit-msg Module Description commit-msg is a customizable git commit message...