Roadmap for Bug Bounty

*CVE-2024-45409 | Ruby-SAML Auth Bypass In GitLab*
_*What You’ll Learn💡*_
1️⃣ *Overview | Discription of CVE-2024-45409*
2️⃣ *Reconnaissance For CVE-2024-45409*
*Shodan.io*
*Censys.io*
*Fofa.info*
*Hunter.how*
*ZoomEYE.HK*
_<======================>_
3️⃣ *E͢x͢p͢l͢o͢i͢t͢ ☣️ CVE-2024-45409 | GiveWP WordPress Plugin Exploit*

4️⃣ *E͢x͢p͢l͢o͢i͢t͢ Installation📥*
5️⃣ *E͢x͢p͢l͢o͢i͢t͢ Tool Guide🧭*
6️⃣ *Impact_💥*
7️⃣ *Severity_⚠️*
8️⃣ *Remediation_♻️*
_https://yashsec.com/bug-bounty/cve-2024-45409-auth-bypass-in-gitlab/

CVE-2024-43582: RCE in RDP Servers, 8.1 rating❗️

A use after free vulnerability in some RDP servers could allow an attacker to carry out remote code execution. The patch is already available.

Search at Netlas.io:
👉 Link: https://nt.ls/Jyn4r
👉 Dork: protocol:rdp

Vendor's advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43582

https://www.sonarsource.com/blog/why-code-security-matters-even-in-hardened-environments/

how to turn a file write vulnerability in a Node.js application into RCE – even though the target's file system is read-only

Bookmark this website they always release good stuff

How would I exploit arbitrary file write into RCE on modern frameworks like Node js, Flask, Django ?

By overwriting existing templates with template injection payloads. ⭐

𝐗𝐒𝐒 𝐢𝐧 𝐏𝐡𝐨𝐧𝐞 𝐍𝐮𝐦𝐛𝐞𝐫 𝐅𝐢𝐞𝐥𝐝 ? 👇

Recently I re-watched the NahamCon2022EU: RTFR (Read The Bleeping RFC) by securinti

One thing I was surprised to find out was that phone number fields can be vulnerable to XSS.

How is that possible?

According to the RFC it is possible to append "optional parameter" to the number. Something like:

 • 10203040;𝐞𝐱𝐭=+22
 • 10203040;𝐢𝐬𝐮𝐛=12345
 • 10203040;𝐩𝐡𝐨𝐧𝐞-𝐜𝐨𝐧𝐭𝐞𝐱𝐭=𝐞𝐱𝐚𝐦𝐩𝐥𝐞

This can lead to XSS if:

1. The library parses phone numbers according to RFC and accepts optional parameters such as "phone-context"

2. The phone number is reflected on the web interface without input validation or output encoding

So payloads like "10203040;𝐩𝐡𝐨𝐧𝐞-𝐜𝐨𝐧𝐭𝐞𝐱𝐭=<𝐬𝐜𝐫𝐢𝐩𝐭>𝐚𝐥𝐞𝐫𝐭(1)</𝐬𝐜𝐫𝐢𝐩𝐭>" CAN be a valid phone number and trigger XSS

https://github.com/tomnomnom/gron

This is one of the best tools for dealing with large JSON data. It makes it easier to query complex JSON and turn it into different formats

I use it always to test web api that sends or receives big json blobs to understand what it's actually doing

Free TryHackMe Access
If you’re unable to purchase a personal voucher, you can use the following account for learning purposes:

TryHackMe Premium Account
Email: [email protected]
Password: pasderemarque@123

Please use the account responsibly—do not change or delete any settings or information.

First Review

XSS from javascript hidden params

assetfinder *.com | gau | egrep -v '(.css|.svg)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars"