Cross-Site Scripting in subscribetocalendar.action

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48910. panel The contents of the 'subCalendarId' parameter is not validated in POST requests to 'subscribetocalendar.action' and...

Automattic: WooCommerce: Support Ticket indirect object reference

Hi there's no protection against Idor, so i can comment on anyone's Ticket. Reproduce Issue: 1.Go Here: https://www.woothemes.com/my-account/tickets/ 2.Create a new Ticket suppose ticked id is : 340529 Comment something on 340529 Ticket, and capture that request In Burp suite. here's the request:...

Burp Suite Professional 1.6.26 - The Leading Toolkit for Web Application Security Testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security...

InVision: Deleting a Project for which the user is not owner but a normal member

A Project member who is not the owner of the project does not have delete option. But using proxy tool like Burp Suite, a low privilege Project member user can delete the Project, Where only the project owner has the privilege to delete the project. Pre-Requisite: A project where current user is...

Local file inclusion vulnerability detection tools – Burp the domestic plug-in LFI scanner checks-vulnerability warning-the black bar safety net

LFI scanner checks to myself to burp the lightweight scanner to do a detect a LFI vulnerability plug-ins, because burp is not an effective detection of the LFI feature, only to write yourself a plugin. Look at the following screenshot: ! To compare the following J2EESCAN inside the included LFI...

XSS Payload Management Framework: Sleepy Puppy

Sleepy Puppy is a cross-site scripting XSS payload management framework which simplifies the ability to capture, manage, and track XSS propagation over long periods of time. Why Should I use Sleepy Puppy? Often when testing for client side injections HTML/JS/etc. security engineers are looking fo...

Burp Suite Tutorial

Ребята из bugcrowd начали записывать видео-руководство по использованию программы Burp Suite Видео ENG: Hacking with Burp Suite - Tutorial 1 Вопросы по курсу...

Web Security Dojo

Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. Virtualbox and VMware versions are available for download. Dojo is an open source project intended to be used as a training environment, and shouldn’t be used as a pen-testing platform due to the...

Slack: Link vulnerability leads to phishing attacks

Hello Guys, Hope you are doing great. I'm sending this email to let you know about a vulnerability i stumbled upon while using slack it's a great app!. While copy-pasting a link from a pdf to slack desktop/web, i noticed that the resulting links looked a bit messed up 1.png Firing up burp and...

BypassWAF - Burp Plugin to Bypass Some WAF Devices

Add headers to all Burp requests to bypass some WAF products. This extension will automatically add the following headers to all requests. X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 Usage Steps include: 1. Add extension to burp 2. Create...

Hishop商城分销系统某处信息泄露

简要描述： RT 详细说明： 前人案例： http://wooyun.org/bugs/wooyun-2010-019206 泄露地址： /SubmmitOrderHandler.aspx?Action=GetUserShippingAddress&ShippingId=2 其中ID值为可控的，用BURP不断遍历可以找出非常多的用户信息 案例： http://demo.kuaidiantong.cn/SubmmitOrderHandler.aspx?Action=GetUserShippingAddress&ShippingId=2...

Autorize - Automatic Authorization Enforcement Detection (Extension for Burp Suite)

Autorize is an automatic authorization enforcement detection extension for Burp Suite. It was written in Python by Barak Tawily, an application security expert at AppSec Labs. Autorize was designed to help security testers by performing automatic authorization tests. Installation 1. Download Burp...

A Year Later, XSS Vulnerability Still Exists in eBay

A potentially dangerous cross-site scripting XSS vulnerability has existed in eBay for more than a year, and it doesn’t appear the company is a rush to fix the issue. Jaanus Kääp, a researcher based in Estonia, discovered the issue more than a year ago when he was looking into the security of web...

Burp Suite Professional v1.6.16 - The Leading Toolkit for Web Application Security Testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security...

Shopify: Lack of SSL Pinning on POS Application ( iOS )

Description Given that this is a POS application and handle CHD, cryptographic security is of most importance. Applications such as Square, Amazons POS, etc. have already implemented this. The iOS application is correctly checking for SSL certs using the os keychain, but due to the lack of checki...

嘉挚科技短信通sql注入

简要描述： rt 详细说明： http://sms.finereason.com/ 首先注册一个用户，登陆。然后在 http://sms.finereason.com/member/ComSms.asp?tid=1 存在在注入。用burp抓包，然后保存。 GET /member/ComSms.asp?tid=1 HTTP/1.1 Host: sms.finereason.com Proxy-Connection: keep-alive Accept:...

Cool Dog PC client remote JS code injection vulnerability(impact of the National cool Dog the user can hung it)-vulnerability warning-the black bar safety net

Mainly using the three vulnerability completed 1 cool Dog Radio backgroundxssvulnerability 2 cool Dog Radio personal background override vulnerability 3 cool Dog Radio home storage-typexssvulnerability 一 :http://www.kugou.com/fm2/app/musicshow/admin/njadmin/index.php Cool Dog Radio personal...

ArcSight Logger - Arbitrary File Upload Code Execution

ArcSight Logger - Arbitrary File Upload Code Execution Exploit Title: ArcSight Logger - Arbitrary File Upload Code Execution Date: 13.03.2015 Exploit Author: Julian Horoszkiewicz Vendor Homepage: www.hp.com Software Link:...

Doyo建站最新版本存在CSRF添加管理员漏洞

简要描述： Doyo建站最新版本存在CSRF添加管理员漏洞 详细说明： 在后台添加管理员打开burp抓下包看看是怎么样的带入数据库的 None 漏洞证明：...

Vimeo: A user can enhance their videos with paid tracks without buying the track

It is possible to enhance videos with paid tracks without buying the track. Steps to verify: 1. Log into vimeo.com and navigate to https://vimeo.com/enhancer. 2. Click on any paid music track and note down the track id from the URL ex:...