bugbounty技巧聚合20220211 - 火线 Zone-安全攻防社区

bugbounty技巧聚合20220211

43999

漏洞报告

自动填充导致信息泄露1900$
https://hackerone.com/reports/1083922
垂直越权 800$
https://hackerone.com/reports/1392032
Spring Boot信息泄露 5000$
https://hackerone.com/reports/1022048

挖洞技巧

Bypass Cloudflare WAF
https://www.astrocamel.com/web/2022/01/25/my-sqli-adventure-or-why-you-should-make-sure-your-waf-is-configured-properly.html
零点击RCE-Peloton Bike（安卓设备）
https://www.nowsecure.com/blog/2022/02/09/a-zero-click-rce-exploit-for-the-peloton-bike-and-also-every-other-unpatched-android-device/
Firefox JIT Use-After-Frees | Exploiting CVE-2020-26950
https://www.sentinelone.com/labs/firefox-jit-use-after-frees-exploiting-cve-2020-26950/

挖洞工具

思科 CVE-2022-20699 exp
https://github.com/Audiobahn/CVE-2022-20699
腾讯云 key泄露利用工具
https://github.com/freeFV/Tencent_Yun_tools
阿里云 key泄露利用工具
https://github.com/mrknow001/aliyun-accesskey-Tools