PRO TIP TO DETECT CSTI

- in your proxy add a match and replace rule for some keywords to make changes in the response

eg : TESTCSTI = {{7*9}}

CVE-2024-8698: Privelege Escalation in Keycloak, 7.7 rating❗️

Improper SAML signature verification allows an attacker to create a document that is only partially signed. Due to the vulnerability, the entire document will be considered signed, which may lead to privelege escalation.

Search at Netlas.io:
👉 Link: https://nt.ls/LJfRK
👉 Dork: http.favicon.hash_sha256:47dcf1f1a8f1afd68297a294a263849069a7a62b2e86550241416c2cc56c5676

Read more: https://access.redhat.com/security/cve/CVE-2024-8698

CVE-2024-47062: SQL Injection and Auth Bypass in Navidrome Music Server, 9.4 rating 🔥

The latest advisory disclosed several vulnerabilities, which in theory allow an attacker to gain access to sensitive data.

Search at Netlas.io:
👉 Link: https://nt.ls/N9Jj8
👉 Dork: http.description:"Navidrome Music Server"

Vendor's advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6

⚡️Google Dorks - Vulnerable Parameters ⚡️


⛔️XSS prone parameters:

inurl:q= | inurl:s= | inurl:search= | inurl:query= | inurl:keyword= | inurl:lang= inurl:& site:example[.]com

⛔️Open Redirect prone parameters

inurl:url= | inurl:return= | inurl:next= | inurl:redirect= | inurl:redir= | inurl:ret= | inurl:r2= | inurl:page= inurl:& inurl:http site:example[.]com

⛔️SQLi Prone Parameters

inurl:id= | inurl:pid= | inurl:category= | inurl:cat= | inurl:action= | inurl:sid= | inurl:dir= inurl:& site:example[.]com

⛔️SSRF Prone Parameters

inurl:http | inurl:url= | inurl:path= | inurl:dest= | inurl:html= | inurl:data= | inurl:domain= | inurl:page= inurl:& site:example[.]com

⛔️LFI Prone Parameters

inurl:include | inurl:dir | inurl:detail= | inurl:file= | inurl:folder= | inurl:inc= | inurl:locate= | inurl:doc= | inurl:conf= inurl:& site:example[.]com

⛔️RCE Prone Parameters

inurl:cmd | inurl:exec= | inurl:query= | inurl:code= | inurl:do= | inurl:run= | inurl:read= | inurl:ping= inurl:& site:example[.]com

🔆 Credit- Mike Takashi

Methods that no one tells u to find origin ip addresses!!!???

https://forums.cybershieldctf.com/search.php?action=results&sid=3e360b4b477968060184d73068b9f841

#bugbounty #bugbountytips

Usually CI CD integrations are not protected by wafs and reverse proxies, so if you find any small organization's gitlab, jenkin instance etc you'll often find configurations files (from wayback machine, previous commit too +a lot of ways) , they often leak some ip addresses

Authorization bypass due to cache misconfiguration???


https://forums.cybershieldctf.com/search.php?action=getnew

#bugbounty #bugbountytips