This is my first and last Bug Bounty Writeup this year 😀

I am sharing with you my latest XSS finding, which I’ve found 2 weeks ago.

This was the fastest and a bit unusual flow that I normally do when I search for XSS.

So let’s dive in…

• Company asked me to retest an old XSS report.

• I’ve checked that XSS and confirmed that it was fixed properly.

• The specific endpoint had name a param that was vulnerable to Reflected XSS injection.

example.com/profile?name=<img+src=1+onerror=alert(1337)>

• I’ve started to search for a bypass and used the Search function in Chrome Developer tools to search this endpoint /profile in all JS files to check for another vulnerable param, but found another endpoint:

example.com/services

• The first idea that came to my mind was to put this URL in the google search engine and see if this endpoint was cached somewhere on the google web space with params.

• After the first try, I found a cached endpoint with params on the first page of the results, the endpoint had ID param and some other params.

example.com/services?id=123&page=Demo

• I’ve added my payload qwe'"<X</ to the ID param and started to check if anything is reflected somewhere on the webpage’s source code.

example.com/services?id=123qwe'"<X</

• Besides that, I’ve opened the Network tab in Chrome Developer tools to check all requests that this endpoint might send somewhere.

• After the second refresh of the page, I found an interesting AJAX request that used the JSONP callback param together with the ID param from the endpoint itself. The AJAX request URL was similar to this:

lib.com/find?id=123qwe&jsonp=cb12

• The first thing that I tested was the JSONP param itself, to see if I can change it to an alert function with a custom parameter

• To my surprise, there was no check for JSONP value, so I easily changed it to alert(1337);

• Now it was time to check the ID param once again and see if it accepts other symbols, for example, % sign to craft an encoded payload in order to add custom parameters to AJAX URL.

• I’ve changed the endpoint URL to

example.com/services?id=1%26jsonp=alert(1337);%23

• When JS processed it, it transformed %26 to & and %23 to #. Everything that is behind the # (hashtag) symbol is ignored by the browser. The final AJAX call looked like this:

lib.com/find?id=1&jsonp=alert(1337);#&jsonp=cb12

• Using this AJAX URL manipulation (parameter pollution attack) I have successfully triggered an alert box with text 1337. This confirmed the DOM XSS vulnerability existence and I have received a $350 bounty, with an additional $50 for a retest of an old report.

Thanks for reading!

P.S. I’m working on a book for beginners in Bug Bounty world. This book will include Networking, HTML & JavaScript basics, a short description of widespread vulnerabilities, and an in-depth analysis of XSS vulnerability with examples, tips, tools, and tricks. At the end of the book, I will teach you how to create and deploy your own NodeJS service for testing Blind-XSS / SSRF vulnerabilities.

P.S.S. Stay tuned for updates and don’t forget to subscribe at least somewhere so you won’t miss any info regarding the book.

Happy Holidays & Happy New Year! 🎄

Sharing Bug Bounty Tips on

🔸 LinkedIn 🔗 linkedin.com/in/therceman

🔸 Instagram 🔗 instagram.com/therceman

🔸 Telegram 🔗 t.me/therceman

🔸 TikTok 🔗 tiktok.com/@therceman

🔸 YouTube 🔗 youtube.com/therceman

🔸 Twitter 🔗 twitter.com/therceman

Anton (therceman)

Searching for bugs in the wild (not on a bug bounty platform) is great, but not for the start.

Bug bounty platforms can give you very interesting private invites over time.

Try focusing on programs that have a wide scope, where you can manage users (create roles), docs, images, etc.

And then start with a simple — create two users (one basic user & second admin), open two browsers, and start testing for BAC (Broken Access Control) vulnerability.

In short — BAC is the type of vulnerability, where a basic user can perform admin actions.

Some of these vulnerabilities can be found using direct links to sections/endpoints, but others will require you to modify requests that are sent to the browser

I recommend using @Burp_Suite for requests capture & modification. You can download Community Edition for Free.

Recommended Addon: Logger++

While you are testing the website/app for BAC bugs — you can highlight all GET requests to critical actions. E.g. /delete_user?id=1

Requests with critical actions that can be directly sent to a user are treated as a CSRF (Cross-Site Request Forgery) vulnerability

POST requests can be used too to perform CSRF attack, but usually has CSRF protection mechanism in place (like csrf_tokens or referrer check).

CSRF protection can be bypassed sometimes. Try to switch the POST method to GET or remove token value from a key - csrf_token=.

With referrer protection, you can try to append your own domain to a referrer, like this http://example.com.yourdomain.com

And the third basic rule while performing bug bounty hunting — is to put a basic payload in all possible inputs: qwe'"<X</

And just watch text reflection on a website. If you will see somewhere qwe'" (without angle brackets) — this could be a chance of XSS

Additionally, search for qwe text in the source code of the page. Use Developers Tools in the browser for this task.

Some of the input payloads can be reflected in tag parameters: <a class="qwe'"<x</">

Or in <script> element itself: <script> let a = "qwe'"<x</" <script>

That's all for now! Thanks for reading 👍

Follow me on Twitter - https://twitter.com/therceman

I Tweet & Write about WebDev & InfoSec

Let's take a look at the following URL

https://admin:pass@a.beta.example.com:888/users/index.php?q=bob&role=2#info

This URL consist of the following components:

1. Scheme     https://
2. Authority   admin:pass@
3. Host           a.beta.example.com
4. Port            888
5. Path           users/index.php
6. Query        q=bob&role=2
7. Hash         #info

Scheme component

Alternative naming: Protocol
Required: Yes
Example: https://

The scheme specifies which application will be used by a web server (app on Windows/i0S/Android) to open a URL.

For example, opening a URL with the scheme mailto:// will open your webmail application.

• Common examples: https://, http:// , ftp://, mailto://, file://
• Custom app examples: facetime://, slack://, steam://
• Browser specific examples: about://, chrome://
• Additional browser examples: data://, javascript://

Authority component

Alternative naming: HTTP authentication, credentials, authorization
Required: No
Example: admin:pass@

Basic authorization to a web/app resource indicated by @ (at) sign.
Login admin is separated from password pass using : (colon) sign

In some cases password is optional (e.g. https://admin@example.com)

Host component

Alternative naming: Hostname
Required: Yes
Example: a.beta.example.com

The Host consists of multiple domain names separated by . (dot) sign.
Domain name with level > 2 is called sub-domain

1. a               - fourth-level domain (sub-domain)
2. beta          - third-level domain (sub-domain)
3. example    - second-level domain (domain name)
4. com           - top/first-level domain (TLD)

The host can be an IP address in IPv4 (e.g. 193.184.216.34)
or IPv6 (e.g. [2a00:1450:400e:80a::200e]) format

Port component

Required: Yes
Example: 888

The port component indicates which server we are referring to on the target host

The : (colon) sign indicates port component usage. 888 is the port number

The server can accept connections on multiple ports. E.g. port numbers 80 and 443 can be used by a single server:

• 80   - port number is used for basic web connection
• 443 - port number is used for secure (TLS/SSL) web connection

The port :443 or :80 is omitted when a web page has https:// or http:// scheme

Path component

Required: No
Example: /users/index.php

Usually the Path component indicates a path to target file on a server

• /                 - the root path/folder. Let's imagine it is called htdocs
• users          - folder named users inside of htdocs folder
• /index.php - file named index.php inside of users folder

In some cases, the Path component can use custom mapping/scheme/rewrite rule.
The path segments can be linked to a function/method in different files on a server:

• /users/list     - function named list in users.php file.
  show list of all users

• /users/1/read - function named read with argument ID in users.php file.
  show info of user with ID = 1

• /users/images - function named users in image-collection.php file.
  show images of all users

Query component

Alternative naming: Query string, Search string
Required: No
Example: ?q=bob&role=2

The Query component always starts with a ? (question) sign.
It consists of key-value pairs. The value is assigned to a key using the = (equals) sign.
Key-value pairs are separated using & (ampersand) sign.

1. ?       - starting symbol that indicates presence of Query component
2. q       - the first key
3. =       - the sign, that assigns first value to a first key
4. bob   - the first value
5. &       - the key and value pair separator
6. role  - the second key
7. =       - the sign, that assigns second value to a second key
8. 2       - the second value

Example of logic behind this query: get all users named bob with role ID 2

Hash component

Alternative naming: Anchor
Required: No
Example: #info

Usually used by client-side scripting language named Javascript
By default - the browser will make a focus on an element with id after # (hash) sign.
In our case, the focus will be made on an element with ID info

• #       - starting symbol that indicates the presence of Hash component
• info - the value of a Hash component

Example of logic behind this hash: show tab that contains basic info for found users

Thanks for reading 👍

Follow me on Twitter - twitter.com/therceman

As website developers, we encounter recursive functions every day.

This tutorial will explore the pattern of problems, which can be solved using recursion.

Basic Concept

function recurse() {
    // 2nd call to itself
    recurse();
}

// 1st call
recurse();

Each recursive function must have a base case (also called termination condition), where it stops the recursion, or else it will continue calling itself indefinitely.

function recurse() {
    if (terminate)
        return; // stop calling recurse();

    // continue recurse() if there is no termination
    recurse();
}

recurse();

While Loop and Recursion Comparison

The recursion technique looks similar to the while loop.

Imagine that you need to multiply the desired number by themselves X times.

For example: 2 * 2 * 2 = 8

While Loop

function multiply(n, x) {
    let i = 0;
    let res = 1;
    while (i < x) {
      res = res * n;
      i++;
    }
    return res;
}

How does the loop works?

multiply(2,3)

1. i = 0, res = (1) * 2       // 0 < 3 continue ...
2. i = 1; res = (2) * 2       // 1 < 3 continue ...
3. i = 2; res = (2 * 2) * 2   // 2 < 3 continue ...
4. i = 3; res = (2 * 2 * 2)   // 3 < 3 (false) break and return 8

Recursion 🔁

function multiply(n, x) {
    return x > 1 ? n * multiply(n, x - 1) : n;
}

How does the recursion works?

Examples

#1 (String URL Encode)

Let's imagine we need to URL encode the string <html> 5 times

The output should look like this: %252525253Chtml%252525253E

Loop Solution

function encode(str, n) {
    let i = 0;
    while (i < n) {
      str = encodeURI(str)
      i++;
    }
    return str;
}

Recursion Solution 🔁

function encode(str, n) {
    return n ? encode(encodeURI(str), n - 1) : str;
}

#2 (String URL Decode)

Let's imagine we need to decode an URL that has been encoded multiple times

For example let's take previous URL encoded string: %252525253Chtml%252525253E

The output result will be: <html>

Loop Solution

function decode(str) {
    while (str !== decodeURI(str)) {
      str = decodeURI(str)
    }
    return str;
}

Recursion Solution 🔁

function decode(str) {
    return str !== decodeURI(str) ? decode(decodeURI(str)) : str;
}

#3 (String Replace)

Imagine you need to replace bad tags, like <script>, from your HTML code

1st case: hello<script> world<script>

2nd case: hello<sc<script>ript>world

With the first case, we can easily do something like this:

let html_code = 'hello<script> world<script>';
let output = html_code.replaceAll('<script>','');
// output: hello world

But.. with the second case it will fail:

let html_code = 'hello<sc<script>ript> world';
let output = html_code.replaceAll('<script>','');
// output: hello<script> world

Here is where Recursion comes to the rescue

Recursion Solution 🔁

function clean_html(html, bad_tag) {
    let cleaned_html = html.replaceAll(bad_tag, '');
    return html === cleaned_html ? html : clean_html(cleaned_html, bad_tag)
}

clean_html('hello<sc<script>ript> world', '<script>');

// output: hello world

#4 (Find Nested Elements)

In this example, we need to find category by ID in a deeply nested array

Our target is a category with ID number 5

let the_category_list = [
    {"id" : 1, "name" : "fruits", "child_list" : [
        {"id" : 2, "name" : "apple", "child_list" : [
            {"id" : 4, "name" : "red apple", "child_list" : []},
            {"id" : 5, "name" : "green apple", "child_list" : []}
        ]},
        {"id" : 3, "name" : "banana", "child_list" : []}
    ]}
]

Recursion Solution 🔁

function find_category_by_id(id, category_list) {
    let found_category = false;

    category_list.forEach(category => {
        if (category.id === id)
            found_category = category;

        if (found_category === false && category.child_list.length)
            found_category = find_category_by_id(id, category.child_list)
    }); 

    return (found_category) ? found_category : false;
}

find_category_by_id(5, the_category_list)

// Output: {id: 5, name: "green apple", child_list: Array(0)}

#5 (Factorial Using Recursion)

This example will show you how to write a factorial program in javascript using recursion

Let's imagine we need a factorial of 5: 1 * 2 * 3 * 4 * 5 = 120

Recursion Solution 🔁

function factorial(x) {
    return x ? x * factorial(x - 1) : 1; 
}

#6 (Fibonacci Series Using Recursion)

In this example, you will learn how to write a program to print Fibonacci series using recursion

Fibonacci sequence is written as: 0, 1, 1, 2, 3, 5, 8, 13, 21, …

Recursion Solution 🔁

function fibonacci(num) {
    return num < 2 ? num : fibonacci(num - 1) + fibonacci(num - 2);
}

function fibonacci_printer(numberOfTerms) {
    let out = [];
    for(let i = 0; i < numberOfTerms; i++) {
        out.push(fibonacci(i));
    }
    console.log(out.join(', '));
}

To use this program, you need to call fibonacci_printer(5) and the output will be:
0, 1, 1, 2, 3

Thanks for reading!

More examples will be added later.

Follow me on Twitter - twitter.com/therceman

Key Features

🔷 Developer by Google in 2010

🔷 Open Source

🔷 Extension -> .webp

🔷 MIME type -> image/webp

🔷 Lossless Compression

🔷 Supports Animation

🔷 Supports Alpha Transparency

🔷 Used by Google, Bind, Facebook

Browser Support

✅ Chrome >= v9 (2011 year)

✅ Firefox >= v65 (2019 year)

✅ Opera >= v11.5 (2011 year)

✅ Edge >= v19 (2019 year)

✅ Safari iOS >= v14.4 (2020 year)

✅ Safari* >= v14 (2020 year) // Safari needs macOS 11 or later

⛔ Internet Explorer* (no native support) // IE needs fallback/polyfill

How To Use

1) Using <picture> + <img> tag

<picture>
  <source srcset="img/original.webp" type="image/webp">
  <source srcset="img/fallback.jpg" type="image/jpeg"> 
  <img src="img/fallback.jpg" alt="Alt Text!">
</picture>

Note This option is recommended, the browser will select its own supported format

2) Using <img> tag only

  <img src="img/fallback.jpg" alt="Alt Text!">

Note Only choose this option if you don't care about old browsers (like Internet Explorer)

How To Create

Google has created its own package for Linux, Windows and macOS with command-line tools that can be used to transform your existing images (PNG, GIF, JPG) to WEBP format

Link: https://developers.google.com/speed/webp/download

This package includes:

• The libwebp library, which can be used to add WebP encoding or decoding to your programs.
• cwebp -- WebP encoder tool
• dwebp -- WebP decoder tool
• vwebp -- WebP file viewer
• webpmux -- WebP muxing tool
• gif2webp -- Tool for converting GIF images to WebP

Usage (Windows Example)

cwebp.exe delivery_parcel.png -q 80 -o delivery_parcel.webp

• delivery_parcel.png - source file
• -q 80 - quality param set to 80%
• -o delivery_parcel.webp - output file

Online Converters

• https://cloudconvert.com/webp-converter
• https://convertio.co/png-webp/

CMS & JS Frameworks Support

CMS

• Drupal: https://drupal.org/project/webp
• Joomla: https://extensions.joomla.org/instant-search/?jed_live%5Bquery%5D=webp
• Magento: https://marketplace.magento.com/catalogsearch/result/?q=webp
• WordPress: https://wordpress.org/plugins/search/convert+webp/

JS Frameworks (that has optimized image component)

• NextJS
• Gatsby
• Nuxt

CDN Automatic Conversion

Some CDNs support automatic next-gen conversion of your images, like Cloudflare (although it's not a free feature and comes with a PRO plan - $20/mo)

Thanks for reading 👍

Follow me on Twitter - https://twitter.com/therceman

Let's begin...

Domain registration on GoDaddy

1) You have to come up with your desired domain name

Note: This is the hardest part of this tutorial 😅

Let's imagine that you have chosen the following domain name mynickname.dev

2) Go to https://godaddy.com, enter your domain and click Search

3) If the domain name is available - add it to your cart and hit Continue to Cart

4) In the second section uncheck the box Start your website for FREE

Note Additionally you can enable Full Domain Privacy & Protection (recommended)

5) On the final page you need to remove Standard SSL since Hashnode & Cloudflare will set up their own life-free SSL certificates.

Note You can change 2 Years to 1 Year - it will be cheaper to start.

6) Continue to checkout and pay for the domain

Domain registration on Cloudflare

1) Navigate to https://www.cloudflare.com/ and create your account

After creating an account click on the section named Protect your internet presence

2) Enter your domain name and hit Add site

3) Select Free plan and hit Continue

4) Click on the newly created domain name

5) Copy Nameserver 1 and Nameserver 2 URL's from the config page

Changing nameservers on GoDaddy

1) Navigate back to your GoDaddy account, go to the home page and click on your domain

2) Click on DNS and select Manage Zones from the dropdown

3) Search for your domain on the next page and click on it

4) In the Nameservers section click the Change button

5) Check I'll use my own nameservers and enter copied Nameserver 1 and Nameserver 2

6) After ~5-30 minutes you will receive an email that your domain is ready, you can go back to your Cloudflare dashboard and check the status

Hashnode setup for custom domain

1) Go to your Hashnode account, click your profile image and select Blog Dashboard

2) Scroll down and click the Domain button

3) Enter your domain name or blog subdomain for your domain and hit Update

Note In this example we are using the blog subdomain. e.g. blog.mynickname.dev

4) On the next page with configurations, you need to copy the Host name & Value fields.

Cloudflare final setup for Hashnode domain

1) Go to your Cloudflare account, select your domain and then click the DNS button

2) Click the Add record button, select CNAME as Type.

3) Put copied Host name value into Name field and Value value into Target field

4) Click on Proxy status to set it to gray and Save

After ~ 5 - 10 minutes go back to your Hashnode account and check the status of your domain

If everything is OK - you can now use it

Thank you for your time, Have a nice day!

Best Regards, Anton (therceman)

Find me on Twitter