1558 matches found
Osmedeus - Automatic Reconnaisance And Scanning In Penetration Testing
Automatic Reconnaisance and Scanning in Penetration Testing What is Osmedeus? Osmedeus allow you to doing boring stuff in Pentesting automatically like reconnaissance and scanning the target by run the collection of awesome tools. Installation git clone https://github.com/j3ssie/Osmedeus cd...
PoC Exploit Compromises Microsoft Live Accounts via Subdomain Hijacking
A proof-of-concept PoC attack details how an attacker can gain access a victim’s Microsoft Live webmail session, without having the person’s credentials. It relies upon the hijack of a Microsoft-owned Live.com website subdomain. The PoC, developed by CyberInt, demonstrates what it characterizes a...
Chaturbate: Stored XSS in chat topic due to insecure emoticon parsing on any message type
Description The funcitonality for adding emoticons into the chat from the serverside perspective is based on a string in the following format: %%%emoticon NAME|EMOTICONURL|WIDTH|HEIGHT|REPORTURL%%% The EMOTICONURL must conform to the following regex: javascript...
Infog - Information Gathering Tool
InfoG is a Shellscript to perform Information Gathering. Features Check Website info Check Phone info IP Tracker Check Valid E-mail Check if site is Up/Down Check internet speed Check Personal info Find IP behind Cloudflare Find Subdomains Port Scan Multi-threaded Check CMS Check DNS leaking Usag...
Shopify: Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.com
Good day, I truly hope it treats you great on your side of the screen : I have found that your website tim-exclusive.shopify.com is pointed via a cname to an unclaimed Heroku Instance This was not registered on Heroku. I was able to take over the domain: See my POC Pug of Concept...
Shopify: H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.com
Hi team!, I'm reporting a Session Fixation issue on multiple shopify-built apps hosted on .shopifycloud.com and .shopifyapps.com. Normally Session Fixation is boring but I discovered a way to simply use by-design XSS to authenticate as a user on those affected apps. Details As the policy pointed...
TakeOver v1 - Extracts CNAME Record Of All Subdomains At Once
What isSubdomain Takeover? Subdomain takeover is a class of vulnerability where subdomain points to an external service that has been deleted. The external services are Github, Heroku, Gitlab, Tumblr and so on. Let’s assume we have a subdomain sub.example.com that points to an external service su...
SubScraper - External Pentest Tool That Performs Subdomain Enumeration Through Various Techniques
SubScraper uses DNS brute force, Google & Bing scraping, and Virus Total to enumerate subdomains without an API. Written in Python3, SubScraper performs HTTPS requests and DNS "A" record lookups during the enumeration process to validate discovered subdomains. This provides further information to...
Shopify: subdomain Takeover at blog.exchangemarketplace.com
Hi , I believe that exchangemarketplace.com is belong to shopify it was vulnerable to Subdomain Takeover so I takeover it to my shopify store Poc : goto blog.exchangemarketplace.com Suggested fix : clear your subdomain dns Impact Subdomain Takeover...
See how do I find Starbucks subdomain hijacking vulnerability-vulnerability warning-the black bar safety net
! Recently, I seem to and Starbucks and by Chance, the continuous discovery of its two sub-domain name hijacking vulnerability, the balloon won$4000 dollars. Wherein, the first vulnerability is based on Microsoft's Azure cloud service discovery, this time the second vulnerability is also very...
ISC BIND 9 krb5-subdomain and ms-subdomain update policy vulnerability
ISC BIND is the United States Internet Systems Consortium ISC company maintains a set of open source software that implements the DNS protocol. To provide fine-grained control over the ability to update records in a zone using Dynamic DNS DDNS, BIND provides a feature called update-policy. Variou...
IBM: Reflected XSS and Blind out of band command injection at subdomain dstuid-ww.dst.ibm.com
I found an XSS and Blind OS based injection issue due to the incorrect handling of the characters in THE EMAIL get& post parameters. A injected and a sleep command succesfully executed, the following link works as a PoC that alerts the string in the script: I reproduced the same on Firefox and IE...
Greenhouse.io: Subdomain Takeover on demo.greenhouse.io pointing to unbouncepages
Actuall this report is same as of this one:- https://hackerone.com/reports/38007 Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker to set up a page on t...
Khan Academy: Possible Take Over Subdomain For Inbound Emails
Hello KhanAcademy Security Team, I'm rootbakar, The researcher identified that the affected url points to sendgrid.net, via a DNS CNAME record. As a result of this an attacker could potentially initate a subdomain take over by registering the subdomain sendgrid.khanacademy.org on sendgrid and...
BillCipher - Information Gathering Tool For A Website Or IP Address
Information Gathering tool for a Website or IP address, use some ideas from Devploit. BillCipher can work in any operating system if they have and support Python 2, Python 3, and Ruby. Features DNS Lookup Whois Lookup GeoIP Lookup Subnet Lookup Port Scanner Page Links Zone Transfer HTTP Header Ho...
Khan Academy: Possible Subdomain Takeover
None of the weakness categories really fit this so I apologize for that. The subdomain learnstormindia.khanacademy.org points to 52.203.185.84 a webflow.io proxy server proxy-ssl.webflow.com. The CNAME entry in the subdomain is pointing to an external page service learnstormindia.khanacademy.org...
Subdomain Enumeration Tool: Amass
Amass is the subdomain enumeration tool with the greatest number of disparate data sources that performs analysis of the resolved names in order to deliver the largest number of quality results. Amass performs scraping of data sources, recursive brute forcing, crawling of web archives, permuting...
marinazz.com XSS vulnerability
Open Bug Bounty ID: OBB-667882 Description| Value ---|--- Affected Website:| marinazz.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
DuckDuckGo: XSS in Subdomain of DuckDuckGo
A cross-site scripting vulnerability was discovered in a subdomain of DuckDuckGo. The subdomain had a Content Security Policy header intended to prevent script execution, but this could be bypassed in Internet Explorer. As a result, malicious scripts could be injected and executed in the...