akit1337

Story of SSRF SSRF to admin access http://1.Target  was like this-> http://Site.com/users/view/data?uri= … 2. Fetching data from internal resources so I tried uri=http://0.0.0.0 , Got default internal page . Here is exploit uri=http://0.0.0.0/administrator/dashboard. No auth on admin

When testing for SSRF using a black list, take internal IP addresses and when encoding them, dont encode entire IP. Encode 1 octet of the IP address, or 2 or 3. For Instance: AWS Metadata - 0251.254.169.254 (this got the $160,000 payout in Oct 2018) #bugbountytip #bugbounty

#ffuf @ngkogkos @joohoi @Jhaddix Subdomain bruteforce with ffuf on 443 port. It works fine ffuf -u https://FUZZ.rootdomain.com  -w jhaddixall.txt -v | grep "| URL | " | awk '{print $4}'

When testing for SSRF, change the HTTP version from 1.1 to HTTP/0.9 and remove the host header completely. This has worked to bypass several SSRF fixes in the past. #bugbountytip #bugbountytip #bugbounty

Takeover story of repo 1.A site having github logo 2. Example: Click on logo it'll show you git repo(http://github.com/site/ ) 3. In my case , It was 404 Main part 4. Created git account with name of company , So it was like http://github.com/site/  Successful takeover