আসসালামু আলাইকুম, আজ এই পোষ্টটি লিখার কোন ইচ্ছা ছিল না বাট লিখতে বসলাম কিছু প্রশ্নের উত্তর দিতে ও সিন্যাক নিয়ে অনেকে জানতে চেয়েছেন সেই সম্পর্কে লিখতে । অনেকে হইত আমার গত পোষ্টটি https://www.facebook.com/groups/vorhelpcenter/permalink/691994155058387/ পরেছেন । এই পোষ্টটির কিছু বিষয় নিয়ে তাদের গ্রুপের কিছু পোষ্ট দেখলাম যেগুলার screenshot
তো পোষ্টগুলাই দুইটা জিনিস কমন তা হল -
যদি আমার গত পোষ্টটি পড়েন তাহলে সম্পূর্ণ পোষ্টে কোথাও আপনি এমন একটি লাইন খুঁজে পাবেন না যেইখানে আমি শেয়ার আইপি নিয়ে কোন কথা বলছি । তাহলে বার বার পোষ্টে শেয়ার আইপি কথাটি উল্লেখ করে তিনি বা তাহারা কি প্রমাণ করতে চায় ? …
Hello Fellow Hackers!
I am sitting in my room for last 3 days due to corona virus outbreak world wide and feeling really bored . So I thought why not do a write-up what I promised really long ago 🤭. Few months back in My Tweet I shared a way to bypass XSS WAF & Character limitation what I found on a private bug bounty site. Today I will share more technical details about that bypass . Hope you guys will enjoy it 😇
Back in 2019 I was testing a web application what allows a user to create a photo album and upload photos in it and the interface looks like below screenshot…
Hi readers ,
At 1st Eid Mubarak to all . May Allah bring you joy, happiness, peace and prosperity on this blessed occasion. Wishing you and your family on this happy occasion of Eid! Eid Mubarak! So on this blessed occasion I thought let’s share one of my finding as Eid bonus 😜 !
From title you may came to know this is a write-up about XSS WAF bypass using UNICODE . So let’s give you a small idea about the application I was testing . There was a option called Save for later what saves items in your account for later use . …
Hi readers ,
Today I will write about a XSS Vulnerability I reported to postnl.nl bug bounty Program .
Vulnerable Endpoint :- http://realestate.postnl.nl/?Lang=
To test a normal Reflected XSS I Input “><xsstest> in the Lang parameter and in source it was reflected properly inside META tag like below :-
<meta name="language" content=""><xsstest>" />
Looks simple right ? Then wait a little :’) . Then I Inputted “><img src=x> and I got :-
I tried with many HTML tags and I got 2 points here :-
So I googled for meta tag attributes and got…
Hi guys ,
This is Prial Islam a security researcher from Bangladesh . This is a old finding of mine adding into my blog . Recently I disclosed a POC on How I was able to get all vine users sensitive Information including Phone no/ IP Address / Emails and Many more what was reported to twitter and they patched it and rewarded me 7560$ . Those who missed it you can get the Orginal Report Here .
Today I am going to disclose another Information Disclosure vulnerability what was reported by me to Twitter Security team in their Bug Bounty Program in Hackerone and they Rewarded me with a amount of 5040$ for this report . …
This is Prial Islam a security researcher from Bangladesh . This is a old finding of mine adding into my blog .
Today I will write about a Critical IDOR vulnerability that will lead to Information Disclosure what allowed me to get any Vine user’s sensitive information including Ip address/phone no/email .
Hi readers ,
Today I will write about Subdomain takeover . It’s a common Security issue what is actually developers mistake when they left a Unused/unclaimed 3rd party Service DNS CNAME record for a subdoamin of theirs and Hackers can claim those subdomains with the help of external services it pointing to what could lead to serious issues . You can learn more about Subdomain takeover from detectify blog .
While testing flock.com I got a domain flock.co what is under flock company . So I stared looking at it’s subdomains and got subdomain newdev.flock.co . …
Hi readers ,
I am a Cyber Security Researcher from Bangladesh . Again I am here to share a Security issue I found on WeTransfer . WeTransfer have a paid bugbounty program under Zerocopter . So I start testing their sites . While I was bruteforcing wetransfer.com with DIRB script I got some directories what was redirecting users to Medium Publication link . Those directories looks like :-
zerocopter.com is a bug bounty platform for Ethical hackers just like Hackerone . In zerocopter reports user can use Markdown . Users are also allowed to give external links in reports . If a user click on External link in reports then it takes the user to a external warning page like below screenshot :-
But I was able to bypass the external warning page and redirect a user to a external link without any warning page .
Hi readers ,
I am a Cyber Security Researcher from Bangladesh . This is my 1st write-up and also I am not good at XSS so forgive all mistakes .
Recently I was testing a private site and in that site users can add their personal information . I noticed a Input there named Secret Key which allows user to process payments and store transaction information to an application.
So I input a Normal payload :-
“><img src=x onerror=prompt(document.domain)>
and it got filtered and the page source was like :-
<input type="text" id="****" name="****" value=""><img img" class="form-control" rel="gp" data-size="20" data-character-set="a-z,A-Z,0-9">
So from the source I understand that…