Канал: Bug Bounty España

Partial construction race conditions

Partial construction race conditions

Exploiting time-sensitive vulnerabilities

Exploiting time-sensitive vulnerabilities

Single-endpoint race conditions

Single-endpoint race conditions

Multi-endpoint race conditions

Multi-endpoint race conditions

Bypassing rate limits via race conditions

Bypassing rate limits via race conditions

Bypassing GraphQL brute force protections

Bypassing GraphQL brute force protections

Performing CSRF exploits over GraphQL

Performing CSRF exploits over GraphQL

Limit overrun race conditions

Limit overrun race conditions

Finding a hidden GraphQL endpoint

Finding a hidden GraphQL endpoint

Accidental exposure of private GraphQL fields

Accidental exposure of private GraphQL fields

Accessing private GraphQL posts

Accessing private GraphQL posts

Visible error-based SQL injection

Visible error-based SQL injection

SameSite Lax bypass via cookie refresh

SameSite Lax bypass via cookie refresh

SameSite Strict bypass via sibling domain

SameSite Strict bypass via sibling domain

SameSite Strict bypass via client-side redirect

SameSite Strict bypass via client-side redirect

SameSite Lax bypass via method override

SameSite Lax bypass via method override

Exfiltrating sensitive data via server-side prototype pollution

Exfiltrating sensitive data via server-side prototype pollution

Remote code execution via server-side prototype pollution

Remote code execution via server-side prototype pollution

Bypassing flawed input filters for server-side prototype pollution

Bypassing flawed input filters for server-side prototype pollution

Detecting server-side prototype pollution without polluted property reflection

Detecting server-side prototype pollution without polluted property reflection

Privilege escalation via server-side prototype pollution

Privilege escalation via server-side prototype pollution

Discovering vulnerabilities quickly with targeted scanning

Discovering vulnerabilities quickly with targeted scanning

Client-side prototype pollution via flawed sanitization

Client-side prototype pollution via flawed sanitization

DOM XSS via an alternative prototype pollution vector

DOM XSS via an alternative prototype pollution vector

Client-side prototype pollution in third-party libraries

Client-side prototype pollution in third-party libraries

Client-side prototype pollution via browser APIs

Client-side prototype pollution via browser APIs

DOM XSS via client-side prototype pollution

DOM XSS via client-side prototype pollution

Client-side desync

Client-side desync

Server-side pause-based request smuggling

Server-side pause-based request smuggling

Browser cache poisoning via client-side desync

Browser cache poisoning via client-side desync

Host validation bypass via connection state attack

Host validation bypass via connection state attack

CL.0 request smuggling

CL.0 request smuggling

JWT authentication bypass via algorithm confusion with no exposed key

JWT authentication bypass via algorithm confusion with no exposed key

JWT authentication bypass via algorithm confusion

JWT authentication bypass via algorithm confusion

JWT authentication bypass via kid header path traversal

JWT authentication bypass via kid header path traversal

JWT authentication bypass via jku header injection

JWT authentication bypass via jku header injection

JWT authentication bypass via jwk header injection

JWT authentication bypass via jwk header injection

JWT authentication bypass via weak signing key

JWT authentication bypass via weak signing key

JWT authentication bypass via flawed signature verification

JWT authentication bypass via flawed signature verification

JWT authentication bypass via unverified signature

JWT authentication bypass via unverified signature

DOM XSS in jQuery selector sink using a hashchange event

DOM XSS in jQuery selector sink using a hashchange event

Web shell upload via race condition

Web shell upload via race condition

Remote code execution via polyglot web shell upload

Remote code execution via polyglot web shell upload

Web shell upload via obfuscated file extension

Web shell upload via obfuscated file extension

Web shell upload via extension blacklist bypass

Web shell upload via extension blacklist bypass

Web shell upload via path traversal

Web shell upload via path traversal

Web shell upload via Content-Type restriction bypass

Web shell upload via Content-Type restriction bypass

Remote code execution via web shell upload

Remote code execution via web shell upload

Web cache poisoning via HTTP/2 request tunnelling

Web cache poisoning via HTTP/2 request tunnelling

Bypassing access controls via HTTP/2 request tunnelling

Bypassing access controls via HTTP/2 request tunnelling

HTTP/2 request splitting via CRLF injection

HTTP/2 request splitting via CRLF injection

HTTP/2 request smuggling via CRLF injection

HTTP/2 request smuggling via CRLF injection

H2.CL request smuggling

H2.CL request smuggling

Response queue poisoning via H2.TE request smuggling

Response queue poisoning via H2.TE request smuggling

CSRF where token is tied to non-session cookie

CSRF where token is tied to non-session cookie

Internal Cache Poisoning

Internal Cache Poisoning

SSRF via OpenID dynamic client registration

SSRF via OpenID dynamic client registration

Stealing OAuth access tokens via a proxy page

Stealing OAuth access tokens via a proxy page

Stealing OAuth access tokens via an open redirect

Stealing OAuth access tokens via an open redirect

OAuth account hijacking via redirect_uri

OAuth account hijacking via redirect_uri

Forced OAuth profile linking

Authentication bypass via OAuth implicit flow

Authentication bypass via OAuth implicit flow

Exploiting HTTP request smuggling to capture other users' requests

Exploiting HTTP request smuggling to capture other users' requests

Authentication bypass via encryption oracle

Authentication bypass via encryption oracle

Infinite money logic flaw

Infinite money logic flaw

Password reset poisoning via dangling markup

Password reset poisoning via dangling markup

SSRF via flawed request parsing

SSRF via flawed request parsing

Authentication bypass via flawed state machine

Authentication bypass via flawed state machine

Inconsistent handling of exceptional input

Inconsistent handling of exceptional input

Low-level logic flaw

Low-level logic flaw

Magic Recon 2.0 By Anubis 6/6

Magic Recon 2.0 By Anubis 6/6

Magic Recon 2.0 By Anubis 5/6

Magic Recon 2.0 By Anubis 5/6

Magic Recon 2.0 By Anubis 4/6

Magic Recon 2.0 By Anubis 4/6

Magic Recon 2.0 By Anubis 3/6

Magic Recon 2.0 By Anubis 3/6

Magic Recon 2.0 By Anubis 2/6

Magic Recon 2.0 By Anubis 2/6

Magic Recon 2.0 By Anubis 1/6

Magic Recon 2.0 By Anubis 1/6

Flawed enforcement of business rules

Flawed enforcement of business rules

Insufficient workflow validation

Insufficient workflow validation

Weak isolation on dual-use endpoint

Weak isolation on dual-use endpoint

Inconsistent security controls

Inconsistent security controls

Web cache poisoning via ambiguous requests

Web cache poisoning via ambiguous requests

Routing-based SSRF

Routing-based SSRF

Host header authentication bypass

Host header authentication bypass

Basic password reset poisoning

Basic password reset poisoning

High-level logic vulnerability

High-level logic vulnerability

Excessive trust in client-side controls

Excessive trust in client-side controls

Exploiting HTTP request smuggling to perform web cache deception

Exploiting HTTP request smuggling to perform web cache deception

Exploiting HTTP request smuggling to perform web cache poisoning

Exploiting HTTP request smuggling to perform web cache poisoning

Exploiting HTTP request smuggling to deliver reflected XSS

Exploiting HTTP request smuggling to deliver reflected XSS

Exploiting HTTP request smuggling to reveal front-end request rewriting

Exploiting HTTP request smuggling to reveal front-end request rewriting

Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability

Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability

HTTP request smuggling, confirming a TE.CL vulnerability via differential responses

HTTP request smuggling, confirming a TE.CL vulnerability via differential responses

HTTP request smuggling, confirming a CL.TE vulnerability via differential responses

HTTP request smuggling, confirming a CL.TE vulnerability via differential responses

HTTP request smuggling, obfuscating the TE header

HTTP request smuggling, obfuscating the TE header

HTTP request smuggling, basic TE.CL vulnerability

HTTP request smuggling, basic TE.CL vulnerability

HTTP request smuggling, basic CL.TE vulnerability

HTTP request smuggling, basic CL.TE vulnerability

Server-side template injection with a custom exploit

Server-side template injection with a custom exploit

Server-side template injection in a sandboxed environment

Server-side template injection in a sandboxed environment

Server-side template injection with information disclosure via user-supplied objects

Server-side template injection with information disclosure via user-supplied objects

Server-side template injection in an unknown language with a documented exploit

Server-side template injection in an unknown language with a documented exploit

Server-side template injection using documentation

Server-side template injection using documentation

Basic server-side template injection (code context)

Basic server-side template injection (code context)

Basic server-side template injection

Basic server-side template injection

Exploiting XXE via image file upload

Exploiting XXE via image file upload

Exploiting XInclude to retrieve files

Exploiting XInclude to retrieve files

Exploiting XXE to retrieve data by repurposing a local DTD

Exploiting XXE to retrieve data by repurposing a local DTD

Exploiting blind XXE to retrieve data via error messages

Exploiting blind XXE to retrieve data via error messages

Exploiting blind XXE to exfiltrate data using a malicious external DTD

Exploiting blind XXE to exfiltrate data using a malicious external DTD

Blind XXE with out-of-band interaction via XML parameter entities

Blind XXE with out-of-band interaction via XML parameter entities

Blind XXE with out-of-band interaction

Blind XXE with out-of-band interaction

Exploiting XXE to perform SSRF attacks

Exploiting XXE to perform SSRF attacks

Exploiting XXE using external entities to retrieve files

Exploiting XXE using external entities to retrieve files

Referer-based access control

Referer-based access control

Multi-step process with no access control on one step

Multi-step process with no access control on one step

Insecure direct object references [IDOR]

Insecure direct object references [IDOR]

User ID controlled by request parameter with password disclosure

User ID controlled by request parameter with password disclosure

User ID controlled by request parameter with data leakage in redirect

User ID controlled by request parameter with data leakage in redirect

User ID controlled by request parameter, with unpredictable user IDs

User ID controlled by request parameter, with unpredictable user IDs

User ID controlled by request parameter

User ID controlled by request parameter

Method-based access control can be circumvented

Method-based access control can be circumvented

URL-based access control can be circumvented

URL-based access control can be circumvented

User role can be modified in user profile

User role controlled by request parameter

User role controlled by request parameter

Unprotected admin functionality with unpredictable URL

Unprotected admin functionality with unpredictable URL

Unprotected admin functionality

Unprotected admin functionality

File path traversal, validation of file extension with null byte bypass

File path traversal, validation of file extension with null byte bypass

File path traversal, validation of start of path

File path traversal, validation of start of path

File path traversal, traversal sequences stripped with superfluous URL-decode

File path traversal, traversal sequences stripped with superfluous URL-decode

File path traversal, traversal sequences stripped non-recursively

File path traversal, traversal sequences stripped non-recursively

File path traversal, traversal sequences blocked with absolute path bypass

File path traversal, traversal sequences blocked with absolute path bypass

File path traversal, simple case

File path traversal, simple case

Clobbering DOM attributes to bypass HTML filters

Clobbering DOM attributes to bypass HTML filters

Exploiting DOM clobbering to enable XSS

Exploiting DOM clobbering to enable XSS

DOM-based cookie manipulation

DOM-based cookie manipulation

DOM-based open redirection

DOM-based open redirection

DOM XSS using web messages and JSON.parse

DOM XSS using web messages and JSON.parse

DOM XSS using web messages and a JavaScript URL

DOM XSS using web messages and a JavaScript URL

DOM XSS using web messages

DOM XSS using web messages

Blind SSRF with Shellshock exploitation

Blind SSRF with Shellshock exploitation

Blind SSRF with out-of-band detection

Blind SSRF with out-of-band detection

SSRF with filter bypass via open redirection vulnerability

SSRF with filter bypass via open redirection vulnerability

SSRF with whitelist-based input filter

SSRF with whitelist-based input filter

SSRF with blacklist-based input filter

SSRF with blacklist-based input filter

Basic SSRF against another back-end system

Basic SSRF against another back-end system

Basic SSRF against the local server

Basic SSRF against the local server

Blind OS command injection with out-of-band data exfiltration

Blind OS command injection with out-of-band data exfiltration

Blind OS command injection with out-of-band interaction

Blind OS command injection with out-of-band interaction

Blind OS command injection with output redirection

Blind OS command injection with output redirection

Blind OS command injection with time delays

Blind OS command injection with time delays

OS command injection, simple case

OS command injection, simple case

Cross-site WebSocket hijacking

Cross-site WebSocket hijacking

Manipulating the WebSocket handshake to exploit vulnerabilities

Manipulating the WebSocket handshake to exploit vulnerabilities

Manipulating WebSocket messages to exploit vulnerabilities

Manipulating WebSocket messages to exploit vulnerabilities

Password brute-force via password change

Password brute-force via password change

Password reset poisoning

Password reset poisoning

Password reset broken logic

Password reset broken logic

Offline password cracking

Offline password cracking

Brute-forcing a stay-logged-in cookie

Brute-forcing a stay-logged-in cookie

2FA bypass using a brute-force attack

2FA bypass using a brute-force attack

Magic Recon By Anubis [bugpoc.com]

Magic Recon By Anubis [bugpoc.com]

2FA broken logic

2FA broken logic

2FA simple bypass

2FA simple bypass

Broken brute-force protection, multiple credentials per request

Broken brute-force protection, multiple credentials per request

Username enumeration via account lock

Username enumeration via account lock

Broken brute-force protection, IP block

Broken brute-force protection, IP block

Username enumeration via response timing

Username enumeration via response timing

Username enumeration via subtly different responses

Username enumeration via subtly different responses

Username enumeration via different responses

Username enumeration via different responses

Cache key injection

Cache key injection

URL normalization

URL normalization

Web cache poisoning via a fat GET request

Web cache poisoning via a fat GET request

Parameter cloaking

Parameter cloaking

Web cache poisoning via an unkeyed query parameter

Web cache poisoning via an unkeyed query parameter

Web cache poisoning via an unkeyed query string

Web cache poisoning via an unkeyed query string

Combining web cache poisoning vulnerabilities

Combining web cache poisoning vulnerabilities

Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria

Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria

Targeted web cache poisoning using an unknown header

Targeted web cache poisoning using an unknown header

Web cache poisoning with multiple headers

Web cache poisoning with multiple headers

Web cache poisoning with an unkeyed cookie

Web cache poisoning with an unkeyed cookie

Web cache poisoning with an unkeyed header

Web cache poisoning with an unkeyed header

CORS vulnerability with internal network pivot attack

CORS vulnerability with internal network pivot attack

CORS vulnerability with trusted insecure protocols

CORS vulnerability with trusted insecure protocols

CORS vulnerability with trusted null origin

CORS vulnerability with trusted null origin

CORS vulnerability with basic origin reflection

CORS vulnerability with basic origin reflection

Multistep clickjacking

Multistep clickjacking

Exploiting clickjacking vulnerability to trigger DOM-based XSS

Exploiting clickjacking vulnerability to trigger DOM-based XSS

Clickjacking with a frame buster script

Clickjacking with a frame buster script

Clickjacking with form input data prefilled from a URL parameter

Clickjacking with form input data prefilled from a URL parameter

Basic clickjacking with CSRF token protection

Basic clickjacking with CSRF token protection

Information disclosure in version control history

Information disclosure in version control history

Authentication bypass via information disclosure

Authentication bypass via information disclosure

Source code disclosure via backup files

Source code disclosure via backup files

Information disclosure on debug page

Information disclosure on debug page

Information disclosure in error messages

Information disclosure in error messages

Using PHAR deserialization to deploy a custom gadget chain

Using PHAR deserialization to deploy a custom gadget chain

Developing a custom gadget chain for PHP deserialization

Developing a custom gadget chain for PHP deserialization

Developing a custom gadget chain for Java deserialization

Developing a custom gadget chain for Java deserialization

Exploiting Ruby deserialization using a documented gadget chain

Exploiting Ruby deserialization using a documented gadget chain

Exploiting PHP deserialization with a pre-built gadget chain.

Exploiting PHP deserialization with a pre-built gadget chain.