Skip to content

twseptian/bug-bounty-testing-essential-guideline-startup-bug-hunters

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits

README.md

README.md

 
 

Repository files navigation

Bug Bounty Testing Essential Guideline : Startup Bug Hunters

These types of weaknesses can allow an attacker to either capture or bypass the authentication methods that are used by a web application.

  • User authentication credentials are not protected when stored.
  • Predictable login credentials.
  • Session IDs are exposed in the URL (e.g., URL rewriting).
  • Session IDs are vulnerable to session fixation attacks.
  • Session value does not timeout or does not get invalidated after logout.
  • Session IDs are not rotated after successful login.
  • Passwords, session IDs, and other credentials are sent over unencrypted connections.

The goal of an attack is to take over one or more accounts and for the attacker to get the same privileges as the attacked user.

Source : https://www.owasp.org/index.php/Broken_Authentication_and_Session_Management

Privilege Escalation

Privilege escalation vulnerability allows malicious user to obtain privileges of another user they are not entitled to. Privilege escalation occurs in two forms: Vertical privilege escalation – Occurs when user can access resources, features or functionalities related to more privileged accounts.

Hackerone Reports :

Source : https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)

Authentication Bypass

Note : Authenticating a user involves establishing that the user is in fact who he claims to be. Without this facility, the application would need to treat all users as anonymous the lowest possible level of trust. A flaw in the application that allows users to access application resources without authentication is referred as’ Authentication Bypass. Authentication bypass vulnerability is generally caused when it is assumed that users will behave in a certain way and failing to foresee the consequences of users doing the unexpected.

we are going to focus on four key areas which should be examined when testing authentication:

  • Forced Browsing
  • Parameter Modification
  • Session Identifier Prediction
  • SQL Injection within Login Forms

Hackerone Reports :

Source : https://zseano.com/tutorials/3.html
Source : https://www.bugcrowd.com/authentication-bypass/
https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)

Weak Login Function

Depending on the nature of the password-protected resource, an attacker can mount one or more of the following types of attacks:

Access the contents of the password-protected resources.Access password-protected administrative mechanisms such as "dashboard", "management console" and "admin panel," potentially progressing to gain full control of the application.

Source : https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)

Session Fixation

session fixation attacks attempt to exploit the vulnerability of a system that allows one person to fixate another person's session identifier. Most session fixation attacks are web based, and most rely on session identifiers being accepted from URLs or POST data.

Hackerone Reports :

Source : https://www.owasp.org/index.php/Session_fixation
Source : http://projects.webappsec.org/w/page/13246960/Session Fixation

Missing Secure or HTTPOnly Cookie Flag

HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie.
Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted tunnel. For example, after logging into an application and a session token is set using a cookie,then verify it is tagged using the ";secure" flag. If it is not, then the browser believes it safe to pass via an unencrypted channel such as using HTTP.

Hackerone Reports : https://hackerone.com/reports/75357​

Source :

Failure to Invalidate Session

Does not properly invalidate Session IDs. User sessions or authentication tokens (particularly single sign-on (SSO) tokens) aren't properly invalidated during logout or a period of inactivity.

On Logout (Client and Server-Side)

Failure to invalidate the session on the server when the user chooses to logout. The act of logging out should invalidate the session identifier cookie on the client browser as well as invalidated the session object on the server. Failure to do so will allow the session to be re-animated after logout.

Hackerone Reports : https://hackerone.com/reports/193556

Long Timeout

Failure to invalidate the session when the user closes the browser without logging out. Failure to do so will allow the session to be re-animated in a new browser session. Failure to automatically terminate the session on the server after some predefined period of inactivity.

Failure to do so means the application has no protection from an attacker resuming an abandoned user session.

Hackerone Reports : https://hackerone.com/reports/244875

On Password Reset and/or Change

User not always get a notification about password change. When a user changes his password via password reset link then such a notification is not sent to the user.

Web app did not verify the email addresses of user accounts before sending an email to them. An attacker can use this functionality and send faulty password reset links to legitimate users.

Hackerone Reports :

Concurrent Sessions On Logout

When login to webapp using two different computers I can easily browse the session concurrently . This means that if an attacker somehow knows the password of the user by any means he can login using that info and the main user will not get notified.

Hackerone Reports :

On Email Change

The e-mail change functionality does not require the current user password to be completed. Since the e-mail could be used to reset the password of the account, could associate a new e-mail to the account, change the primary e-mail associated with the new one and then use the "forgot password" functionality to reset it.

Hackerone Reports : ​

Source :

Concurrent Logins

When a user logs in more than the specified number of times, the new user session is allowed access, but the oldest user session is locked out from further access. By locking out the oldest session instead of the newest session.

Sensitive Data Exposure - Essential Guideline

Sensitive Data Exposure occurs when an application does not adequately protect sensitive information. This vulnerability allows an attacker to access sensitive data such as credit cards, tax IDs, authentication credentials, etc to conduct credit card fraud, identity theft, or other crimes. Losing such data can cause severe business impact and damage to the reputation.

Source :

Critically Sensitive Data

Password Disclosure

Private API Keys

An API Key and Secret Key are secret tokens used to authenticate you with servers. API Key and Secret Key are only known to you and the server. It is important to keep both keys confidential to protect your account.

User Enumeration

User enumeration is when a malicious actor can use brute-force to either guess or confirm valid users in a system. User enumeration is often a web application vulnerability, though it can also be found in any system that requires user authentication. Two of the most common areas where user enumeration occurs are in a site's login page and its ‘Forgot Password' functionality.

Source :

Visible Detailed Error/Debug Page

Detailed Server Configuration

You can view detailed configuration information for the content server that a backed-up Web site was located on at the time of the backup. This information includes the custom metadata fields, content types, security groups, configuration and environment settings, installed components, defined providers, and so on.

This information is especially useful when you must restore a site and want to configure the content server so that it matches the server where the site originated.

Source :

Full Path Disclosure

Full Path Disclosure refers to being able to see the full path of something hosted on the server. It’s often, but not always, the location of the script itself.

Hackerone Reports :

Source : https://www.owasp.org/index.php/Full_Path_Disclosure Source : https://support.detectify.com/customer/en/portal/articles/2243201-full-path-disclosure

Descriptive Stack Trace

A descriptive stack trace describes the sequence of functions and events that led to a certain point in the execution of a program. To put it even more simply, when web app explodes, it tells you where it exploded and what steps it followed that led to the explosion. You can effectively use it as a map to debug code.

Hackerone Reports :

Source : https://medium.com/@jgefroh/the-dreaded-stack-trace-2692c053b28e Source : https://www.owasp.org/index.php/Testing_for_Stack_Traces_(OTG-ERR-002)

Token Leakage via Referer

The reset password token is leaking through the HTTP referer header ... This happens when user clicks at the link sent to their email and when the page is rendered with the token at the URL. There are currently two priority levels for Token Leakage via Referer, the first is P4 when the token is being sent over HTTP, the second is a P5 when the token is sent over HTTPS. I think these should be consolidated into a P4 as the risk here is that the token is going to end up in the logs of the destination server.

Hackerone Reports :

Source : https://robots.thoughtbot.com/is-your-site-leaking-password-reset-links Source : https://portswigger.net/kb/issues/00500400_cross-domain-referer-leakage

Sensitive Token in URL

Information exposure through query strings in URL is when sensitive data is passed to parameters in the URL. This allows attackers to obtain sensitive data such as usernames, passwords, tokens (authX), database details, and any other potentially sensitive data.

Source : https://portswigger.net/kb/issues/00500700_session-token-in-url

Source : https://www.owasp.org/index.php/Information_exposure_through_query_strings_in_url

Hackerone Reports :

Weak Password Reset Implementation

The web app contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. It is common for an application to have a mechanism that provides a means for a user to gain access to their account in the event they forget their password.

Source : https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet
[https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)
(https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009) "https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)")

Password Reset Token Sent Over HTTP

Hackerone Reports :

Cleartext Transmission of Sensitive Data

Hackerone Reports : https://hackerone.com/reports/173268

Directory Listing Enabled

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers. Exposing the contents of a directory can lead to an attacker gaining access to source code or providing useful information for the attacker to devise exploits, such as creation times of files or any information that may be
encoded in file names. The directory listing may also compromise private or confidential data.

Hackerone Reports :

Disclosure of Known Public Information

Hackerone Reports : https://hackerone.com/reports/378122

Mixed Content (HTTPS Sourcing HTTP)

This means that the URL in question is loaded over a secure HTTPS protocol, but some other resources (such as images, videos, stylesheets, scripts) are loaded over an insecure HTTP connection.

Hackerone Reports :

Source : https://resources.infosecinstitute.com/https-mixed-content-vulnerability/
Source : https://sitebulb.com/hints/security/mixed-content-loads-http-resources-on-https-url/

Sensitive Data Hardcoded

Web app contains hardcoded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. If hard-coded passwords are used, it is almost certain that malicious users will gain access to the account in question. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

OAuth Secret

Hackerone Reports :

File Paths

This one is particularly dangerous, because the filename and path are hardcoded in the webapp. An attacker can modify index page path for ./dir/dir/, open the file and see something like MD5 digests and can be brute forced (with enough time) or dictionary cracked by a malicious user, thus giving administrator access to the forum.

Hackerone Reports : https://hackerone.com/reports/291200
Source : https://cwe.mitre.org/data/definitions/798.html

Internal IP Disclosure

In some cases, web servers may be prone to sharing internal IP addresses in response to specially crafted queries. Discovering the private addresses used within an organization can help an attacker in carrying out network-layer attacks aiming to penetrate the organization's internal infrastructure.

Hackerone Reports :

Source : https://portswigger.net/kb/issues/00600300_private-ip-addresses-disclosed

JSON Hijacking

JSON Hijacking is similar to CSRF(Cross Site Request Forgery) but there is just a little bit difference, In CSRF you trick the victim/user to do some malicious/unwanted activity but in JSON Hijacking you trick the user to access a crafted link which will read some data form victim account and pass it to attacker.

Hackerone Reports : https://hackerone.com/reports/54034
Source : https://www.thesecuritybuddy.com/vulnerabilities/what-is-json-hijacking-or-javascript-hijacking/

Cross Site Script Inclusion (XSSI)

Browsers prevent pages of one domain from reading pages in other domains. But they do not prevent pages of a domain from referencing resources in other domains. In particular, they allow images to be rendered from other domains and scripts to be executed from other domains.
An included script doesn't have its own security context. It runs in the security context of the page that included it. For example, if www.evil.example.com includes a script hosted on www.google.com then that script runs in the evil context not in the google context. So any user data in that script will "leak."

Hackerone Reports :

Source : https://www.scip.ch/en/?labs.20160414

Insufficient Security Configurability - Essential Guideline

It occurs when a webapp permits an attacker to access sensitive content or functionality without having to properly authenticate. Strong authentication, encryption and security logging are not available.
Weak passwords, a lack of multifactor authentication and application vulnerabilities create risks.

Source : https://www.owasp.org/index.php/Top_10_2014-I8_Insufficient_Security_Configurability

Weak Password Policy

The weakness occurs when the application does not check complexity or minimum length of the provided passwords. Entire security of application depends on its authentication mechanism. Weak password requirements allow users to create weak passwords, susceptible to a variety of attacks.

Hackerone Reports :

Source : https://cwe.mitre.org/data/definitions/521.html
Source : https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)

Weak Password Reset Implementation

The password change and reset function of an application is a self-service password change or reset mechanism for users. This self-service mechanism allows users to quickly change or reset their password without an administrator intervening.

Hackerone Reports : https://hackerone.com/reports/8082
Source : https://cwe.mitre.org/data/definitions/640.html
https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)

Token is Not Invalidated After Use

Token is Not Invalidated After Email Change

Hackerone Reports : ​https://hackerone.com/reports/223461

Token is Not Invalidated After Password Change

https://hackerone.com/reports/220185
https://hackerone.com/reports/244642

Token is Not Invalidated After New Token is Requested

https://hackerone.com/reports/176116
https://hackerone.com/reports/272839

Lack of Verification Email

Hackerone Reports : ​https://hackerone.com/reports/90643

Lack of Notification Email

Hackerone Reports :

Weak Registration Implementation

Hackerone Reports :​https://hackerone.com/reports/263846

Weak 2FA Implementation

Unvalidated Redirects and Forwards - Essential Guideline

Web app frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.

Hackerone Reports :

Source : https://hdivsecurity.com/owasp-unvalidated-redirects-and-forwards
Source : https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet

Tabnabbing

Reverse tabnabbing is an attack where a page linked from the target page is able to rewrite that page, for example to replace it with a phishing site. As the user was originally on the correct page they are less likely to notice that it has been changed to a phishing site, especially it the site looks the same as the target.

Hackerone Reports :

Source : ​https://www.owasp.org/index.php/Reverse_Tabnabbing

Server Security Misconfiguration - Essential Guideline

Improper server or web application configuration leading to various flaws Debugging enabled, Incorrect folder permissions, Using default accounts or passwords,
Setup/Configuration pages enabled. Current web app security architectures do not follow security by default. On the contrary, programmers must apply security measures to avoid access to private or confidential resources.

Source : ​https://www.owasp.org/index.php/Top\_10-2017\_A6-Security_Misconfiguration

Using Default Credentials

These default username and password combinations are widely known by penetration testers and malicious attackers, who can use them to gain access to various types of custom, open source, or commercial applications.

Hackerone Reports :

Source : ​https://www.owasp.org/index.php/Testing\_for\_default\_credentials\_(OTG-AUTHN-002)
https://www.owasp.org/index.php/Testing_for_Default_or_Guessable_User_Account_(OWASP-AT-003)

Misconfigured DNS

Subdomain Takeover

Subdomain takeover vulnerabilities occur when a subdomain (subdomain.example.com) is pointing to a service (e.g. GitHub pages, Heroku, etc.) that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that subdomain.

For example, if subdomain.example.com was pointing to a GitHub page and the user decided to delete their GitHub page, an attacker can now create a GitHub page, add a CNAME file containing
subdomain.example.com, and claim subdomain.example.com.

Source : https://0xpatrik.com/takeover-proofs/
Source : https://0xpatrik.com/subdomain-takeover-basics/
Source : https://www.hackerone.com/blog/Guide-Subdomain-Takeovers

OAuth Misconfiguration

OAuth is an open standard for authorization, commonly used as a way for Internet users to log in to third party websites using their Microsoft, Google, Facebook, Twitter, One Network etc. accounts without exposing their password.

Account Takeover

Hackerone Reports :

Insecure Redirect URI

Hackerone Reports : ​https://hackerone.com/reports/270028

Mail Server Misconfiguration

Missing SPF records are a common and long-standing security issue that puts sensitive information at risk. We found that less than half of those domains have configured email authentication correctly to prevent spoofed emails being sent from their domains, which means that users are at risk of receiving false emails appearing to come from domains that they trust.

Source : https://blog.detectify.com/2016/06/20/misconfigured-email-servers-open-the-door-to-spoofed-emails-from-top-domains/

Missing SPF on Email Domain

Missing SPF on Non-Email Domain

Database Management System (DBMS) Misconfiguration

The database typically contains the crown jewels of any environment; it usually holds the most business sensitive information which is why it is a high priority target for any attacker.

Hackerone Reports :

Source :

Lack of Password Confirmation

Delete Account

Hackerone Reports : ​https://hackerone.com/reports/42403

Change Email Address

Hackerone Reports : ​https://hackerone.com/reports/245334

Change Password

Hackerone Reports : ​https://hackerone.com/reports/546

No Rate Limiting on Form

Registration

Hackerone Reports : ​https://hackerone.com/reports/275186

Login​

Email-Triggering

Directory Listing Enabled

The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may contain files that are not normally exposed through links on the web site.

Source : ​https://cwe.mitre.org/data/definitions/548.html

Sensitive Data Exposure

An attacker can see the files located in the directory and could potentially access files which disclose sensitive information. Like attacker access system enabled directory.

Non-Sensitive Data Exposure

Hackerone Reports :

Same-Site Scripting

Hello, I'd like to document what appears to be a common named misconfiguration that can result in a minor security issue with web applications. It's a common and sensible practice to install records of the form "​localhost. IN A 127.0.0.1​" into nameserver configurations, bizarrely however, administrators often mistakenly drop the trailing dot, introducing an interesting variation of Cross-Site Scripting (XSS) I call Same-Site Scripting. The missing dot indicates that the record is not fully qualified, and thus queries of the form "​localhost.example.com​" are resolved. While superficially this may appear to be harmless, it does in fact allow an attacker to cheat the RFC2109 (HTTP State Management Mechanism) same origin restrictions, and therefore hijack state management data.

Hackerone Reports :

Source : ​https://www.securityfocus.com/archive/1/486606
Source : ​https://www.soom.cz/clanky/1158--Same-Site-Scripting-SSS

Unsafe File Upload

Arbitrary code execution is possible if an uploaded file is interpreted and executed as code by the recipient. This is especially true for .asp and .php extensions uploaded to web servers because these file types are often treated as automatically executable, even when file system permissions do not specify execution. For example, in Unix environments, programs typically cannot run unless the execute bit is set, but PHP programs may be executed by the web server without directly invoking them on the operating system.

Source : ​https://resources.infosecinstitute.com/file-upload-vulnerabilities/
Source : ​https://www.owasp.org/index.php/Test\_Upload\_of\_Malicious\_Files_(OTG-BUSLOGIC-009)

File Extension Filter Bypass | No Antivirus

Hackerone Reports :

No Size Limit

Exposed Admin Portal - To Internet

Do not enable access to your management interface from the internet or from other untrusted zones inside your enterprise security boundary. This applies whether you use the dedicated management port (MGT) or you configured a data port as your management interface.

Hackerone Reports : ​https://hackerone.com/reports/297339
Source :

Lack of Security Headers

Whenever a browser requests a page from a web server, the server responds with the content along with HTTP Response Headers. Some of these headers contain content meta data such as the content-encoding, cache-control, status error codes, etc. In many cases they are very easy to implement and only require a slight web server configuration change.
HTTP security headers provide yet another layer of security by helping to mitigate attacks and security vulnerabilities.

Source : ​https://geekflare.com/http-header-implementation/
Source : ​https://www.keycdn.com/blog/http-security-headers
Source : ​https://www.thesslstore.com/blog/http-security-headers

Content-Security-Policy ​|​ X-Content-Security-Policy ​|​ X-Webkit-CSP

The content-security-policy HTTP header provides an additional layer of security. This policy helps prevent attacks such as Cross Site Scripting (XSS) and other code injection attacks by defining content sources which are approved and thus allowing the browser to load them.

Example : content-security-policy: script-src 'self' https://www.google-analytics.com
Source : ​https://www.keycdn.com/support/content-security-policy
Source : ​https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

X-XSS-Protection

The x-xss-protection header is designed to enable the cross-site scripting (XSS) filter built into modern web browsers. This is usually enabled by default, but using it will enforce it. It is supported by Internet Explorer 8+, Chrome, and Safari. Here is an example of what the header looks like.

Example : x-xss-protection: 1; mode=block

X-Frame-Options

The x-frame-options header provides clickjacking protection by not allowing iframes to load on your site. It is supported by IE 8+, Chrome 4.1+, Firefox 3.6.9+, Opera 10.5+, Safari 4+. Here is an example of what the header looks like.

Example : x-frame-options: SAMEORIGIN

Public-Key-Pins

The public-key-pins header tells the web browser to associate a public key with a certain web server to prevent MITM attacks using rogue and forged X.509 certificates. This protects users in case a certificate authority is compromised. Here is an example of what the header looks like.

Example : public-key-pins: pin-sha256="t/OMbKSZLWdYUDmhOyUzS+ptUbrdVgb6Tv2R+EMLxJM="; pin-sha256="PvQGL6PvKOp6Nk3Y9B7npcpeL40twdPwZ4kA2IiixqA="; pin-sha256="ZyZ2XrPkTuoiLk/BR5FseiIV/diN3eWnSewbAIUMcn8="; pin-sha256="0kDINA/6eVxlkns5z2zWv2/vHhxGne/W0Sau/ypt3HY="; pin-sha256="ktYQT9vxVN4834AQmuFcGlSysT1ZJAxg+8N1NkNG/N8="; pin-sha256="rwsQi0+82AErp+MzGE7UliKxbmJ54lR/oPheQFZURy8="; max-age=600; report-uri="​https://www.keycdn.com​"

Source : ​https://scotthelme.co.uk/hpkp-http-public-key-pinning/

X-Content-Type-Options

The x-content-type header prevents Internet Explorer and Google Chrome from sniffing a response away from the declared content-type. This helps reduce the danger of drive-by downloads and helps treat the content the right way. Here is an example of what the header looks like.

Example : x-content-type-options: nosniff

Strict-Transport-Security

The strict-transport-security header is a security enhancement that restricts web browsers to access web servers solely over HTTPS. This ensures the connection cannot be establish through an insecure HTTP connection which could be susceptible to attacks.

Example : strict-transport-security: max-age=31536000; includeSubDomains; preload
Source : ​https://caniuse.com/#search=hsts
Source : ​https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

Cache-Control for a Non-Sensitive Page

Content-Security-Policy-Report-Only

Example : Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

Source : ​https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

Path Traversal

SSL Attack (BREACH, POODLE etc.)

All systems and applications utilizing the Secure Socket Layer (SSL) 3.0 with cipher-block chaining (CBC) mode ciphers may be vulnerable. However, the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack demonstrates this vulnerability using web browsers and web servers, which is one of the most likely exploitation scenarios. Some Transport Layer Security implementations are also vulnerable to the attack.

Source : ​https://www.gracefulsecurity.com/tls-ssl-vulnerabilities/
Source : ​https://www.acunetix.com/blog/articles/tls-vulnerabilities-attacks-final-part/

Rate Limit Brute Forcing OTP Vulnerability

Source : https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-Brute_Force(Generic)_/_Insufficient_Anti-automation

Logical Bugs | Vulnerabilities

Hackerone Reports :

Source :
https://medium.com/bugbountywriteup/bugbounty-i-dont-need-your-current-password-to-login-into-your-account-how-could-i-e51a945b083d

Same Site Scripting

It's a common and sensible practice to install records of the form "localhost. IN A 127.0.0.1" into nameserver. administrators often mistakenly drop the trailing dot. The missing dot indicates that the record is not fully qualified, and thus queries of the form "localhost.example.com" are resolved.
While superficially this may appear to be harmless, it does in fact allow an attacker to cheat the RFC2109 (HTTP State Management Mechanism) same origin restrictions, and therefore hijack state management data.

Hackerone Reports : ​https://hackerone.com/reports/1509
Source : ​https://seclists.org/bugtraq/2008/Jan/270

Missing Certification Authority Authorization (CAA) Record

DNS Certification Authority Authorization (CAA) is an Internet security policy mechanism which allows domain name holders to indicate to certificate authorities whether they are authorized to issue digital certificates for a particular domain name. It does this by means of a new "CAA" Domain Name System (DNS) resource record.

Practical | How to test :

Hackerone Reports : ​https://hackerone.com/reports/261706

Source : ​https://www.ssl.com/article/certification-authority-authorization-caa
Source : ​https://www.globalsign.com/en-in/blog/what-is-certificate-authority-authorization-checking

Email Spoofing to Spam Folder

Misconfigured email servers open the door to spoofed emails from top domains Hackerone

Reports : ​https://hackerone.com/reports/263508
Source : ​https://support.google.com/a/answer/7490901?hl=en

Missing or Misconfigured SPF and/or DKIM

DMARC – Domain-based Message Authentication, Reporting and Conformance is a technology that uses the resources of DNS and email servers to help avoid email abuse—specifically, phishing. It is layered over two technologies (SPF and DKIM) that allow for the specification of policies for incoming email. Publishing a DMARC record is one of the Requirements; SPF – Sender Policy Framework is a technology that allows an administrator to publish information about legitimate sending hosts in a specially formatted DNS resource record; DKIM – DomainKeys Identified Mail is a technology that allows a mail receiver to check that incoming mail from a domain is authorized by that domain’s administrators and that the email has not been changed as it has gone through the network.

Practical | How to test :

Hackerone Reports : ​https://hackerone.com/reports/60260
Source : ​https://geekflare.com/fix-email-spoofing-missing-spf-record-vulnerability
Source : ​https://blog.detectify.com/2016/06/20/misconfigured-email-servers-open-the-door-to-spoofed-emails-from-top-domains/

Session Cookie Scoped to Parent Domain

This session cookie is scoped to the parent domain instead of a sub-domain. If a cookie is scoped to a parent domain, then this cookie will be accessible by the parent domain and also by any other sub-domains of the parent domain. This could lead to security problems.

Source : ​https://portswigger.net/kb/issues/00500300_cookie-scoped-to-parent-domain

Missing Secure or HTTPOnly Cookie Flag

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure makes certain client-side attacks, such as cross-site scripting, slightly harder to exploit by preventing them from trivially capturing the cookie's value via an injected script.

Hackerone Reports :

Source : ​https://resources.infosecinstitute.com/securing-cookies-httponly-secure-flags

CAPTCHA ByPass Vulnerability

CAPTCHA ("Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of challenge-response test used by many web applications to ensure that the response is not generated by a computer. CAPTCHA implementations are often vulnerable to various kinds of attacks even if the generated CAPTCHA is unbreakable.

Hackerone Reports :

Source : ​https://www.owasp.org/index.php/Testing\_for\_Captcha_(OWASP-AT-008)
Source : ​https://www.owasp.org/index.php/Testing\_for\_Captcha_(OWASP-AT-012)

Exposed Admin Portal | IP Address Disclosure

Administrator interfaces may be present in the application or on the application server to allow certain users to undertake privileged activities on the site. Tests should be undertaken to reveal if and how this privileged functionality can be accessed by an unauthorized or standard user.

Hackerone Reports :

Source : https://www.owasp.org/index.php/Enumerate_Infrastructure_and_Application_Admin_Interfaces_(OTG-CONFIG-005)

Missing DNSSEC

DNSSEC is a cryptographic security extension to the DNS protocol. The Domain Name System (DNS) translates domain names into IP addresses (and vice versa). If, say, you want to visit example.com, your computer (the client) has to ask a name server for the IP address of example.nl's web server, which will be something like 192.0.2.36 (IPv4) or 2001:db8::2:14 (IPv6).
E-mail and other internet protocols use the same system. With DNSSEC, a digital signature is attached to the DNS information (records) that the server sends to the client, so that the client can check their authenticity.

Practical | How to test :

Hackerone Reports : ​https://hackerone.com/reports/169704
Source : ​https://www.sidn.nl/faq/dnssec?language_id=2
Source : ​https://www.internetsociety.org/deploy360/dnssec/tools

Brute Force Username Enumeration

User enumeration is when a malicious actor can use brute-force to either guess or confirm valid users in a system. User enumeration is often a web applicatio vulnerability, though it can also be found in any system that requires user authentication. Two of the most common areas where user enumeration occurs are in a site's login page and its ‘Forgot Password' functionality.

Source : ​https://blog.rapid7.com/2017/06/15/about-user-enumeration
Source : ​https://www.owasp.org/index.php/Testing\_for\_User\_Enumeration\_and\_Guessable\_User\_Account\_(OWASP-AT-002)

Potentially Unsafe HTTP Method Enabled - OPTIONS | TRACE

HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. Additionally, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method, is examined.

Hackerone Reports :

Source : ​https://www.owasp.org/index.php/Test\_HTTP\_Methods_(OTG-CONFIG-006)
Source : ​https://www.sans.org/reading-room/whitepapers/testing/penetration-testing-web-application-dangerous-http-methods-33945

Lack of Forward Secrecy

Perfect Forward Secrecy is a feature of specific key agreement protocols that gives assurances your session keys will not be compromised even if the private key of the server is compromised. By generating a unique session key for every session a user initiates, even the compromise of a single session key will not affect any data other than that exchanged in the specific session protected by that particular key. Perfect Forward Secrecy represents a huge step forwards in protecting data on the transport layer and following on from Heartbleed, everyone using SSL/TLS should be looking to implement it.

Forward secrecy further protects data on the transport layer of a network that uses common SSL/TLS protocols, including OpenSSL, which had previously been affected by the Heartbleed exploit. If forward secrecy is used, encrypted communications and sessions recorded in the past cannot be retrieved and decrypted should long-term secret keys or passwords be compromised in the future, even if the adversary actively interfered, for example via a man-in-the-middle attack.

Practical | How to test :

Source : ​https://scotthelme.co.uk/perfect-forward-secrecy

Insecure Cipher Suite

A cipher suite is a combination of authentication, encryption and message authentication code (MAC) algorithms. All of which are used during the negotiation of security settings for a TLS/SSL connection as well as for the secure transfer of data.
Hackerone Reports :

Source : ​https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening
Source : ​https://www.owasp.org/index.php/Testing\_for\_Weak\_SSL/TLS\_Ciphers,*Insufficient\_Transport\_Layer_Protection*(OTG-CRYPST-001)

About

Bug Bounty Testing Essential Guideline : Startup Bug Hunters

Topics

bug owasp pentesting owasp-top-10 bugbountytips bugbountytricks bugbounty-writeups bugbounty-reports

Resources

Readme
Activity

Stars

40 stars

Watchers

4 watching

Forks

14 forks
Report repository