All opinions are my own
Your mention of the possibility of cookie stealing motivated me to understand HTTP Request Smuggling again which I had dropped earlier. Please help me understand better: Is cookie/token stealing possible only in a CL-CL scenario?
10 Triaged Crit/P1, 1 Triaged High, 2 Triaged Medium. All of them HTTP Desync bugs in the span of 2 months (The crits being session cookie/token stealing). This bug class is real and needs more attention...
-
-
-
All my findings have been CLTE or TECL. There are 2 ways I steal cookies, the first is by finding an open redirect to collaborator (victim reposts cookies via hijack) and the second is by response queue poisoning which is difficult to explain in a twitter thread (write up soon).
- Još 12 drugih odgovora
Novi razgovor -
-
-
Any writeups coming ?
-
I do have some write-up drafts and pending disclosures. Stay tuned
Kraj razgovora
Novi razgovor -
-
-
Your using the burpsuite plugin or your using your own tool for this?
-
Custom tooling in python
- Još 1 odgovor
Novi razgovor -
-
-
Congrats ! Any dupes ? Really impressed by your results. But it seems to me that with the help of burp extension HTTP Request Smuggler by
@albinowax mostly all bugs are found. -
No dupes. Its easy to think all bugs have been reported by "the better hackers". The reality is there are LOTS more. And that's with the variants James published, there are a lot of unpublished variants yet to be researched and yet to be exploited/reported.
- Još 1 odgovor
Novi razgovor -
-
-
Forgive my ignorance, I'm just getting started on BugBounty, what is this bug about? Is it related with this?https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn …
-
Yes it is related and that is a great starting point
- Još 1 odgovor
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.