Recent content in EdOverflow | Web Developer, Security Researcher, and Author of security.txt on EdOverflow
Yeah, you heard me right: SvelteKit . The past few weeks I have found myself increasingly developing full-stack applications using SvelteKit. I have my reservations about the framework but that is not what this blog post is about. In line with the whole shift-left philosophy, I wanted to make it easy to add security headers across my whole application. In similar fashion to how Helmet plugs into…
A good friend of mine and successful bug bounty hunter, Corben Leo, discussed in a blog post how he spotted an Express app from an error message alone 1 . He used his understanding of Express application code to uncover a critical flaw. I often use the expression, " Learn to build it, then break it " . The philosophy is simple: learn security by building projects, reading official documentation…
If you have ever ventured into the archives of old UNIX books and mailing lists, you will have undoubtedly come across the legend of ed . ed (pronounced /iː diː/) is a text editor just like vim and emacs . However, contrary to its counterparts, ed comes with what an interface that could be best summarised as… $ ed q ? q ? q ? qqqqqqqqqqqqqqqqqq ? q ? q ? q $ In spite of all of this, legend has it:…
Yesterday, I received an email from a reader concerning IETF Request for Comments (RFCs) : “I have heard about hackers reading RFCs. Is there a guide on reading RFCs and what to search for? Because there is way too much information in RFCs, one cannot start going through it manually.” — Afolic This is a brilliant question and one I have heard before but never covered in a blog post.…
An old story of a bug I uncovered and reported to Razer’s vulnerability disclosure programme resurfaced recently while I was chatting with Linus Särud . Back in 2017, I uncovered a snippet of JavaScript code on deals.razerzone.com which handled redirection after a user logged in. // let rurl = document.location.href; if ( razerUserLogin ) { rurl = rurl . split ( 'rurl=' )[ 1 ]; location .…
Recently, @ant0inet (Antoine) tweeted about a cursory scan they did against the .ch TLD to determine how many security.txt files are hosted on the .ch zone. Quick workflow to scan for @securitytxt files on the .ch zone. pic.twitter.com/XfE6xhTDeO — so long and thanks for the phish (@ant0inet) January 15, 2022 I decided it would be fun to explore the data set of $288$ security.txt files. If…
On the evening of January 30th, I checked my phone one last time before going to bed as we millennials do to simulate waking up with a hangover. Tweets started showing up on my feed about a hack related to Houseparty. I notified Karim Rahal and Karel Knibbe that what was unfolding on Twitter could be something we could look into the next day. At first, we did not think much of it but agreed it…
When it comes to bug bounty hunting and finding exciting areas to explore, it is vital to familiarise yourself with the technologies that vendors and companies rely on. One particularly interesting environment that caught our eye was popular integrations used by various open-source projects, primarily as part of their development life cycle. Some prime examples of continuous-integration services…
I must confess, I have been holding on to a small trick that could allow anybody — even those of you that are not into developing and maintaining software — to set up a monitoring system in mere minutes. The reason why I call it the poor man’s monitoring setup is simply to indicate that this setup is not extremely sophisticated, but it does its job beautifully. When bug bounty hunters…
For the past few months, I have been playing around with a tool developed by Tom Hudson called meg and I have fallen in love with this tool. meg is a lightweight URL fetcher that stores the output in organised directories and files. This tool has become the quintessential element in my reconnaissance workflow and has been incorporated into many of my personal tools. Tom comes from a developing…
Abstract Web-of-trust services (WOT) such as Keybase, Onename, and Blockstack promise to verify individuals’ identities on the web. Since many applications on the web are not consistent this often leads to unintended behaviour and therefore security vulnerabilities in web-of-trust services. This write-up analyses three attack vectors that I stumbled across while conducting research on the…
⚠️ Disclaimer (2022): The embedded code no longer works in this blog post since updating my website to Hugo . Some of the content may be missing. Inspired by Daniel Adams ’ work, Tom Hudson and I have assembled a formula to calculate the final bounty amount based on the impact of the reported security vulnerability. The formula can be expressed as follows where $b$ is the bounty amount, $C$…
Preliminary Enter exhibit one: An experienced engineer working for one of the biggest corporations in the world. This engineer had set up a server and claimed that nobody could hack their way into it. Enter exhibit two: An inexperienced kid celebrating their birthday, me (EdOverflow). Queue dramatic music . Step 1 - The Classic Jobert Challenge Going into this CTF I knew that Jobert would use the…
Summary This is a security advisory for a bug that I discovered in Resolv::getaddresses that enabled me to bypass multiple Server-Side Request Forgery filters. Applications such as GitLab and HackerOne were affected by this bug. The disclosure of all reports referenced in this advisory follow HackerOne’s Vulnerability Disclosure Guidelines . This bug was assigned CVE-2017-0904 .…
The following is a lightweight reconnaissance setup that should help you quickly gather information on a given target. We will run through the basic installation steps and then take a look at how to use this setup while hunting. Please keep in mind that there are hundreds of tools out there and there is no way they could all be included in this write-up. This write-up is targeted towards people…
Broken Link Hijacking (BLH) exists whenever a target links to an expired domain or page. Broken Link Hijacking comes in two forms, reflected and stored. This issue has been exploited in the wild numerous times, but surprisingly few researchers actively look for broken links in bug bounty programs. This post aims to give you a basic overview of the different issues that could possibly arise if a…
Note: Please keep in mind, that all of this does not work if you are not signed in to GitHub. When searching for issues related to a target I often like to quickly look up their GitHub organization on Google. So let’s say Gratipay says nothing about being open source. A quick Google “Gratipay GitHub” should return Gratipay’s org page on GitHub. Then from there I am going to…
Step 1 - Recovering the corrupted data According to the doc, the following stream is corrupted: 7b 0a 20 a0 22 65 76 e5 6e 74 22 ba 20 22 70 e1 73 73 77 ef 72 64 5f e3 68 61 6e e7 65 22 2c 8a 20 20 22 f5 73 65 72 ee 61 6d 65 a2 3a 20 22 e2 63 6f 6c ec 69 6e 22 ac 0a 20 20 a2 6f 6c 64 df 70 61 73 f3 77 6f 72 e4 22 3a 20 a2 3a 5c 78 c3 37 5c 78 c6 34 5c 6e dc 78 41 46 a9 29 37 43 dc 78 31 35 dc 78…
GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get…
A list of questions that bug bounty hunters frequently DM me about. 😄 How do I get started with bug bounty hunting? How do I improve my skills? I have a simple philosophy that I share with everyone: Learn to make it. Then break it! Read books. Lots of books. Join discussions and ask questions. Participate in open source projects. Learn to code. Smile when you get feedback and use it to your…