bugbounty技巧聚合20210831 - 火线 Zone-安全攻防社区

bugbounty技巧聚合20210831

45813

漏洞报告

Gitlab

#1113289 Guest users can create new test cases

#475098 A profile page of a user can be denied from loading by appending .html to the username

#1192460 A deactivated user can access data through GraphQL

Kubernetes

#1073363 Index Out Of Bounds in protobuf unmarshalling

挖洞技巧

Exploiting GraphQL – Assetnote

Illogical Apps – Exploring and Exploiting Azure Logic Apps

挖洞工具

https://github.com/assetnote/batchql

https://github.com/dolevf/graphw00f

https://rapiddns.io/ 支持国产，rapiddns数据上云了，更高！更快！更强！