SQL-Injection-IDPS

Payloads All The Things A list of useful payloads and bypass...

Attached files under salaries module can be harvested by unauthenticated users

Description File attachment under salaries module can be downloaded and viewed by anyone without authentication by just knowing the full path /assets/FileUploads/2022/staff2/ and the predictable filename contains date YYYY-MM-DD and a random 6 digit number which can be easily enumerated by...

Captcha Bypass due to invalidation of previous tokens

Description An attacker can create bypass the captcha mechanism and create multiple accounts directly Proof of Concept 1: Sign up with a new name in the application, fill the captcha and intercept the request of the submit. The request will look something like this POST...

MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics

The plugin does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics. 1. Open a WP page with the plugin and Google analytics installed and search for somethi...

Nextcloud: Possibility to delete files attached to deck cards of other users

Hi everyone, Hope you are well ! I come to report here an IDOR vulnerability on the Deck application of Nextcloud, allowing to delete any attached files on any cards. Nextcloud deck app version : latest stable 1.8.0 Steps To Reproduce: The Nextcloud Deck application now offers the ability to add ...

Insufficient Granularity of Access Control

Description There are no rate limits and reuse of captcha is allowed resulting in reuse of same captcha to issue notifications to administrator Proof of Concept Capture the newsletter subscription flow in burp and continue with entering email & captcha until below POST form request is captured...

Reddit: No Rate limit on change password leads to account takeover

Summary: I found when login and go to changing password, there is no rate limit on that function, which leads to takeover the account. Steps To Reproduce: 1-Create account on https://old.reddit.com & move to your setting,In my case I chose !23Qweasdzxc as the password. 2-Go to change password on...

h1-ctf: [ Hacky Holidays CTF ] Completely taken down the Grinch Networks

Day 1 - Robot flag We're presented with sample ui page without any function. So I guessed content discovery is the best way to find flag. And robots.txt came to my mind and found the flag. https://hackyholidays.h1ctf.com/robots.txt Response User-agent: Disallow: /s3cr3t-ar3a Flag:...

Acronis: HTTP Request Smuggling on https://consumer.acronis.com

Summary The website https://consumer.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...

Acronis: HTTP Request Smuggling on https://promosandbox.acronis.com

Summary The website https://promosandbox.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...

PayloadsAllTheThings - A List Of Useful Payloads And Bypass For Web Application Security And Pentest/CTF

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! Every section contains the following files, you can use the templatevuln folder to create a new chapter: README.md - vulnerability description and how to exploit it Intrud...

Urban Dictionary: Bypass voting restriction due to HTTP Header Injection

It is possible to bypass the voting restriction by adding a specially crafted HTTP-Header. The underlying algorithm uses the ip address to restirct the voting of a user. However, by manipulating the IP-Adress via adding the HTTP-Header "X-Forwarded-For" it is possible to vote a entry up or down...

Stripo Inc: Authorization for wp-admin directory are vulnerable to brute force.

The domain https://my.stripo.email in the directory /wp-admin are not blocking amount of request in the authorization form, this leads to bruteforce attack. Where the attacker are able to guess tons of passwords without getting blocked or the password field gets locked. This attack make it possib...

Bumble: The login of Hotor Not is Vulnerable to bruteforce.

I was able to validate that The Login of HotorNot is Vulnerable to BruteForcing . Steps to reproduce: 1. https://hotornot.com/signin 2.Use Burp intruder attack for BruteForcing 3.Send as many requests you want. Fix: Proper mitigation of BruteForcing should be done using Ratelimitng etc...

Boozt Fashion AB: Bruteforce Unlimited number of password attempts

Hi team, This is my first ever report. So, thank you for your patience! URL: https://www.boozt.com/login Browser: Mozilla Firefox 55.0.2 64-bit on Ubuntu Tool: Burp Intruder Boozt account created for testing purposes only. I noticed that on your login page, an attacker can Brute force a login...

GSA Bounty: Race condition on the Federalist API endpoints can lead to the Denial of Service attack

Description Hello. I discovered that the Federalist API doesn't have rate limiting in place, and executes any amount of request to the endpoint in parallel mode. The impact Since you are using the cloud, and i can't test the production environment, impact is theoretical in this case - it can be a...

Snapchat: Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentials

Hey team, While doing some recon for Snapchat's domains, I came across a particular domain of interest - sc-corp.net. It seems that this domain hosts a lot of Snapchat's internal tools, web applications and staging environments such as Phabricator and other administration panels. From analyzing S...

Paragon Initiative Enterprises: CSRF AT SUBSCRIBE TO LIST

Hello, You Have Subscribe Form At http://paragonie.us11.list-manage2.com/subscribe?u=260ff2c88e0a7e103f01ccd79&id=8ddb8569ca When We Enter Details And Click on Subscribe. We Get Following Request Just Try to Add Email 'MERGE0' And Pass the Request , Attacker can Also send that Form Request to Bur...

HackerOne: Restrict any user from logging into his account.

Hackerone's destroys user sessions automatically after signing out,changing password etc.So Old sessions are seems to be worthless for any attacker.But I found something,by exploiting this you can restrict any hackerone user to logging into his account. Pre-Requisition I just need one of his old...

Google Patches Gmail Token Vulnerability

Google has patched a vulnerability that exposes an indefinite number of Gmail addresses, a potential gold mine for phishing and advanced attacks. Researcher Oren Hafif of Israel disclosed details on how he was able to abuse a token exposed in a URL in order to reveal every Gmail address. His work...