Intigriti

Bug Bytes #133 – It’s still DNS, A $50K stray token & Path traversal in microservices

By Anna Hammond

July 28, 2021

Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The first series is curated by Mariem, better known as PentesterLand. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources.

CLICK HERE TO SUBSCRIBE

This issue covers the week from July 19 to 26.

Intigriti News

Intigriti’s July XSS challenge – by @RootEval

Our favorite 5 hacking items

1. Conference of the week

Traversing My Way in the Internal Network – Jasmin Landry (@JR0ch17)

What do you think when you see “?id=1337” in a HTTP request? If it is only IDOR or SQL injection, you will love this talk. @JR0ch17 demonstrates that when microservices are involved, there is much more that can be tested such as path traversal.

2. Writeups of the week

Github access token exposure (Shopify, $50,000)
Guest Blog Post – Attacking the DevTools (Microsoft, $36,000)
Pre-Auth RCE in ManageEngine OPManager
How I Found Multiple Bugs On FaceBook In 1 Month And a Part For My Methodology & Tools (Facebook)

Four beautiful findings:

  • A Shopify employee’s Github Access Token @auguzanellato found while reviewing a public MacOS app and the $50K bounty that ensued.

  • A writeup packed with information on the attack surface of DevTools and $36K of issues @david_erceg found in Edge.

  • A nice pre-auth RCE via deserialization Johannes Moritz and Robin Peraglie found in ManageEngine OPManager.

  • @GodfatherOrwa‘s methodology for finding multiple critical bugs on Facebook in one month.

3. Article of the week

Forgot password? Taking over user accounts Kaminsky style & DNS Reset Checker

Remember 2008 when Dan Kaminsky broke DNS? Well, @sec_consult researcher Timo Longin found out that some Web apps are still vulnerable.
He tested for two DNS attacks (Kaminsky and IP fragmentation attacks) on 146 apps and was able to successfully manipulate the DNS name resolution of some of these apps. This meants that “Forgot password” features could be exploited to steal password reset URLs and take over accounts.

4. Tutorial of the week

How to achieve enterprise-grade attack-surface monitoring with open source software

In this tutorial, @hakluke shows how to make the most of the open source SpiderFoot version to monitor assets with change notifications.

One of the tools mentioned is Datasette. It’s worth knowing about if you store bug bounty data using SQLite and want to turn it into a Web interface with a JSON API.
I was looking for something like this and didn’t know it existed.

5. Resource of the week

blog.0xffff.info

This is a blog I’ve just discovered that has so much good content on Web security. Here are a few examples:

Note that (for me at least) not all posts are visible when browsing the site. So, I’d recommended using an RSS reader to access all the content that is there.

SHARE ON TWITTER

Other amazing things we stumbled upon this week

Videos

Podcasts

Webinars

Conferences

Tutorials

Medium to advanced

Beginners corner

Writeups

Challenge writeups

Pentest writeups

Responsible(ish) disclosure writeups

Bug bounty writeups

See more writeups on The list of bug bounty writeups.

Tools

  • wbk: Advanced waybackurls

  • hakcertstream: Basic implementation of certstream to print new subdomains and domains

  • Bughound & Intro: Static code analysis tool based on Elasticsearch

  • MAN-SPIDER: Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content – regex supported!

  • 5GC_API_parse: A BurpSuite extension to parse 5GC NF OpenAPI 3.0 files to assess 5G core networks

Tips & Tweets

Misc. pentest & bug bounty resources

Challenges

Articles

Bug bounty & Pentest news

Non technical

Community pick of the week

Well done on the “draw our logo” competition Th4nu_0x0! Enjoy your swag 😎

If you want some too, make sure to participate in our ongoing XSS challenge. Also tag us on social media to share your own bug hunting wins and joys, we love hearing from you!

You may also like