bugbounty技巧聚合20211207 - 火线 Zone-安全攻防社区

bugbounty技巧聚合20211207

43999

漏洞报告

【Paragon Initiative Enterprises】密钥泄露
https://hackerone.com/reports/1416665
【Shopify】CSRF 漏洞
https://hackerone.com/reports/1091209
【Shopify】xss is triggered on your web
https://hackerone.com/reports/1121900
【Affirm】IDOR查看用户的订单信息和个人信息
https://hackerone.com/reports/1323406
【Evernote】SSRF读取本地文件内容以及 aws 元数据
https://hackerone.com/reports/1189367

挖洞技巧

如何在 Windows 平台上使用 Powershell 脚本获取反向 shell
https://www.hackingarticles.in/powershell-for-pentester-windows-reverse-shell/
Protecting Windows protected processes | Elastic Blog
https://www.elastic.co/cn/blog/protecting-windows-protected-processes

挖洞工具

GitHub - oxctdev/CVE-2021-38314: Unauthenticated Sensitive Information Disclosure (CVE-2021–38314).
https://github.com/oxctdev/CVE-2021-38314