bugbounty技巧聚合20211215 - 火线 Zone-安全攻防社区

bugbounty技巧聚合20211215

43999

漏洞报告

【MTN Group】表单重复提交
https://hackerone.com/reports/1165223
【MTN Group】XSS漏洞
https://hackerone.com/reports/1091165
【Mail.ru】通过类创建对话框导致存储型XSS
https://hackerone.com/reports/1215179
【Shipt】导出活动 WebView 中的漏洞
https://hackerone.com/reports/414101
【Reddit】没有更改密码的速率限制导致帐户接管
https://hackerone.com/reports/1165285
【Reddit】任务劫持
https://hackerone.com/reports/1325649
【Reddit】参数中的长字符串导致热门标签、社区和用户配置文件上的内部服务器错误
https://hackerone.com/reports/1237428

挖洞技巧

我如何在几分钟内使用 FFUF 和 Sqlmap 找到多个 SQL 注入
https://infosecwriteups.com/how-i-found-multiple-sql-injection-with-ffuf-and-sqlmap-in-a-few-minutes-2824cd4dfab

挖洞工具

SpringBoot获取被星号脱敏的密码的明文
https://github.com/heikanet/SpringBootEnvDecrypt