1732 matches found
Mail.ru: [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover
Unused subdomain of geekbrains.ru was delegated to tilda.cc and unclaimed...
A New Flaw In Zoom Could Have Let Fraudsters Mimic Organisations
In a report shared with The Hacker News, researchers at cybersecurity firm CheckPoint today disclosed details of a minor but easy-to-exploit flaw they reported in Zoom, the highly popular and widely used video conferencing software. The latest Zoom flaw could have allowed attackers mimic an...
SUSE SLES12 Security Update : bind (SUSE-SU-2020:1914-1)
This update for bind fixes the following issues : Amended documentation referring to rule types 'krb5-subdomain' and 'ms-subdomain'. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. CVE-2018-5741...
Website misconfigurations and other errors to avoid
Website owners, listen up: There are lots of things you shouldnβt do with your site, and many more you should avoid with the domains youβre responsible for. Insider malice, bad luck, and the stars aligning in impossible ways can all give your online portfolio a bad hair day. However, if you want ...
PT-2020-14187 Β· Envoy Β· Envoy
Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.12.6 Envoy versions prior to 1.13.4 Envoy versions prior to 1.14.4 Envoy versions prior to 1.15.0 Description: The issue arises when validating TLS certificates, where Envoy incorrectly allows a wildcard DNS Subject...
Mail.ru: Subdomain takeover at msproject.geekbrains.ru
Unused subdomain of geekbrains.ru was deligated to tilda.cc and not claimed...
U.S. Dept Of Defense: Subdomain takeover due to an unclaimed Amazon S3 bucket on βββ
Summary: An unclaimed Amazon S3 bucket on βββββββββ gives an attacker the possibility to gain full control over this subdomain. Description: βββββββ pointed to an S3 bucket that did no longer exists. The bucket points to an Amazon S3 website bucket in the US East region. I claimed this bucket and...
Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager
Cve-2020-5029-finder It is a small script to fetch out the s...
Shopify: Subdomain Takeover of multiple *.ttcdn.co domains
@priyanshuxo demonstrated being able to takeover multiple ttcdn.co subdomains. While we removed the DNS records, the ttcdn.co domain is out of scope for our program, making this report ineligible for a bounty. This is a limited disclosure at their request...
Engel & VΓΆlkers Technology GmbH: reflected xss in ββββββ
Summary: your subdomain : ββββββ suffer from reflected xss bug that leads to execute javascript codes into browser Steps To Reproduce: add details for how we can reproduce the issue 1. visit : βββββ 2. you will see popup and xss confirmed Supporting Material/References: βββββ Impact An attacker c...
U.S. Dept Of Defense: Subdomain takeover of ββββ
Summary: I was able to claim the subdomain: ββββ using Microsoft Azure CDN profiles Description: Impact Platforms Affected: Subdomain Azure CDN Step-by-step Reproduction Instructions 1. Using dig, I was able to determine that the subdomain 'βββββββ' was vulnerable to takeover. The record showed...
h1-ctf: [H1-2006] CTF Writeup
H1-2006 CTF Writeup I am fairly new to CTFs - this is just my second CTF after H1-415 CTF, at which I didn't get far at all. I think the most valuable thing I can do for anyone who comes across this writeup, is to describe exactly what I was thinking at each step along the way, including all my...
h1-ctf: [H1-2006 2020] Exploiting multiple vulnerabilities to get hacker's payment ensured
Last week, Hackeroneβs CEO Marten lost his credentials for BountyPay. A tweet from hackeroneβs official twitter account asked for help from ethical hackers and bounty hunters to help the CEO recover his credentials and insure Mayβs payments. As an active bug hunter on Hackerone, I decided to take...
h1-ctf: [H1-2006 2020] From multiple vulnerabilities to complete ATO on any customer account and staff admin
First of all, thanks for the awesome CTF. I enjoyed it very much : Summary The CTF was about helping HackerOne's beloved CEO, @martenmickos, to approve May bug bounty payments after he has lost his login details for BountyPay. It all started with this tweet: F860982 And as you all know, I had to...
Mail.ru: Subdomain takeover on tilda.geekbrains.ru and fl-change.geekbrains.ru
Few unused subdomains of geekbrains.ru were delegated to tilda.cc and were not claimed...
h1-ctf: @shakedko H1-2006 CTF writeup
TL;DR Flag is: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$. Thank you for this awesome challenge! Introduction I have participated in this CTF as I wanted to see how far I'd be able to get considering the fact that I'm doing bug bounty for a relatively short time. Coming from the software...
Mail.ru: Subdomain Takeover at blog.instamart.ru
It was possible to claim unused instamart.ru subdomain delegated to external cloud service...
CVE-2020-13960
D-Link DSL 2730-U IN1.10 and IN1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, which allows remote attackers to provide valid DNS responses and also offer Internet services such as HTTP for names that otherwise would have had an NXDOMAIN erro...
h1-ctf: [H1-2006 2020] CTF Writeup
Summary: The CTF's objective could be found in the following Twitter post: F858468 As outlined on https://hackerone.com/h1-ctf, all subdomains of bountypay.h1ctf.com are in scope. Doing subdomain enumeration revealed the following subdomains: api.bountypay.h1ctf.com app.bountypay.h1ctf.com...
U.S. Dept Of Defense: Subdomain takeover of βββ
Summary: The subdomain ββββββ had an CNAME record pointing to an unclaimed βββββββ webservice. This is a high severity security issue because an attacker can register the subdomain on βββ and therefore can own the subdomain βββββββββ. Description: The dangling CNAME record of βββββββββ is pointin...