Bug Bytes #132 – RCE on 12.7% of the Internet & Why you should turn off your password manager’s autofill

By Anna Hammond

July 21, 2021

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.

CLICK HERE TO SUBSCRIBE

This issue covers the week from July 12 to 19.

Our favorite 5 hacking items

1. Article of the week

You should turn off autofill in your password manager

@marektoth explored the autofill function of popular password managers. The results are not reassuring: “It is possible to steal the saved login credentials from 11 of the 16 tested browsers and password managers in one mouse click.”.
This is worth knowing both as users (TL;DR: disable the autofill function) and hackers (XSS can be exploited to abuse the autofill feature and steal login credentials).

2. Writeups of the week

Remote code execution in cdnjs of Cloudflare (Cloudflare)
Diving into Dependabot along with a bug in npm (GitHub, $8,117)

@ryotkak discovered a Remote Code Execution via Path traversal on Cloudflare’s cdnjs CDN library. It could have allowed attackers to tamper with 12.7% of all websites on the Internet.

Another interesting finding is @tyage‘s SSRF on GitHub’s Dependabot and RCE in npm. It reads like an investigation starting with the observation that Dependabot is enabled by default and can make commits on many repositories.

3. Tool of the week

CDN

@vortexau‘s CDN is a Python script that compiles a list of subnets for major CDN and WAF providers. It runs every day and outputs results into a YAML file that you can use to quickly identify whether an IP belongs to a CDN of WAF.
This is a timesaver. I love this kind of tool/repo where the work is done once and everyone benefits from it.

4. Resources of the week

BugHuntr.io

Full-time bug hunter @ajxchapman launched a new training platform for bug hunters called bughuntr.io. Currently, it has 13 attack scenarios related to Web and Container/Docker hacking. They are free and range from beginner to expert level.
This is one platform I’m keeping an eye on as more scenarios, premium content and training are planned.

5. Non technical item of the week

Should you do Bug Bounties for a Living?

@codingo_ shares some interesting questions to consider before taking the plunge into full-time bug hunting. This is must reading if you’re thinking about it and want to maximize your chances of success.

SHARE ON TWITTER

Other amazing things we stumbled upon this week

Videos

Podcasts

Webinars

Conferences

Tutorials

Medium to advanced

Beginners corner

Writeups

Challenge writeups

Responsible(ish) disclosure writeups

0-day & N-day vulnerabilities

Bug bounty writeups

See more writeups on The list of bug bounty writeups.

Tools

  • cent: Community edition nuclei templates, a simple tool that allows you to organize all the Nuclei templates offered by the community in one place

  • ppfuzz: Rust tool to scan for prototype pollution

  • requests-ip-rotator: A Python library to utilize AWS API Gateway’s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing

  • SimpleAutoBurp: Python script to run burp scans from CLI using Burp’s REST API

  • Lepus: Python tool for enumerating subdomains, checking for subdomain takeovers and performing port scans

Tips & Tweets

Misc. pentest & bug bounty resources

Challenges

Articles

Bug bounty & Pentest news

Non technical

Community pick of the week

Awesome! Enjoy your well-deserved vacation alicanact60 ⛱️

We love seeing you enjoy your bug bounty life! If you too have wins, swag and joys to share with other Bug Bytes readers, tag us on social media.

You may also like