How would I exploit arbitrary file write into RCE on modern frameworks like Node js, Flask, Django ?

By overwriting existing templates with template injection payloads. ⭐

𝐗𝐒𝐒 𝐢𝐧 𝐏𝐡𝐨𝐧𝐞 𝐍𝐮𝐦𝐛𝐞𝐫 𝐅𝐢𝐞𝐥𝐝 ? 👇

Recently I re-watched the NahamCon2022EU: RTFR (Read The Bleeping RFC) by securinti

One thing I was surprised to find out was that phone number fields can be vulnerable to XSS.

How is that possible?

According to the RFC it is possible to append "optional parameter" to the number. Something like:

 • 10203040;𝐞𝐱𝐭=+22
 • 10203040;𝐢𝐬𝐮𝐛=12345
 • 10203040;𝐩𝐡𝐨𝐧𝐞-𝐜𝐨𝐧𝐭𝐞𝐱𝐭=𝐞𝐱𝐚𝐦𝐩𝐥𝐞

This can lead to XSS if:

1. The library parses phone numbers according to RFC and accepts optional parameters such as "phone-context"

2. The phone number is reflected on the web interface without input validation or output encoding

So payloads like "10203040;𝐩𝐡𝐨𝐧𝐞-𝐜𝐨𝐧𝐭𝐞𝐱𝐭=<𝐬𝐜𝐫𝐢𝐩𝐭>𝐚𝐥𝐞𝐫𝐭(1)</𝐬𝐜𝐫𝐢𝐩𝐭>" CAN be a valid phone number and trigger XSS

https://github.com/tomnomnom/gron

This is one of the best tools for dealing with large JSON data. It makes it easier to query complex JSON and turn it into different formats

I use it always to test web api that sends or receives big json blobs to understand what it's actually doing

Free TryHackMe Access
If you’re unable to purchase a personal voucher, you can use the following account for learning purposes:

TryHackMe Premium Account
Email: [email protected]
Password: pasderemarque@123

Please use the account responsibly—do not change or delete any settings or information.

First Review

XSS from javascript hidden params

assetfinder *.com | gau | egrep -v '(.css|.svg)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars"

- Register An account with email [email protected] on the target
- navigate to support section and see if there are any emails converted into support tickets

credit - NinadMishra
#bugbountytips

Offsec has been acquired by an private equity.
https://www.prnewswire.com/news-releases/leeds-equity-partners-acquires-offsec-302275836.html

🧑‍💻CloakQuest3r - Uncover the true IP address of websites safeguarded by Cloudflare & Others

https://github.com/spyboy-productions/CloakQuest3r

CVE-2024-9634: RCE in GiveWP WordPress Plugin, 9.8 rating 🔥

Another one critical vulnerability in GiveWP. This time, attackers can inject PHP code using one parameter.

Search at Netlas.io:
👉 Link: https://nt.ls/9tUYx
👉 Dork: http.body:"plugins/give/assets/dist"

Read more: https://github.com/advisories/GHSA-6fx6-wrpf-cpgv

Add the file yahoo_site_admin/credentials/db.conf to your wordlist, and you might discover some juicy data.