Armaan Pathan – Medium

Mar 31, 2022

Exploiting DOM Based XSS via Misconfigured postMessage() Function

Today, we will be discussing how to exploit DOM-based XSS through Misconfigured Postmessage function. Two sites can communicate with each other only when they have the same protocol, hostname, and port. If the two sites do not have similar properties mentioned above, it will trigger the Same Origin Policy There…

4 min read

Exploiting DOM Based XSS via Misconfigured postMessage() Function

4 min read

Apr 18, 2019

From SSRF To RCE in PDFReacter

What is PDFReacter? - PDFReacter is a parser which parses HTML content from HTML to PDF. While testing an application I have identified that an application is using the PDFReacter parser. PDFReacter is a formatting processor that parses the HTML content to PDF files.so Since an application has an option…

Java Script

2 min read

PDFReacter SSRF to ROOT Level Local File Read which led to RCE

Java Script

2 min read

Apr 6, 2019

Scary Bug in Burp Suite Upstream Proxy Allows Hackers to Hack Hackers

One day I was playing with a tool debookee (Network Traffic Interception) in the office, I noticed that the tool was intercepting facebook cookies in a plain text. What is Debookee? Debookee is able to intercept and monitor the traffic of any device in the same subnet, thanks to a…

Security

3 min read

Scary Bug in Burp Suite Upstream Proxy Allows Hackers to Hack Hackers

Security

3 min read

Mar 12, 2019

Brute Forcing User IDS via CSRF To Delete all Users with CSRF attack.

While testing an application, there was a module “Delete User” in which an admin can delete any user. If you notice in the request, there is no CSRF Token/Protection implemented into delete user request. This was very easy CSRF that an attacker can send the form to admin and can…

Security

2 min read

Brute Forcing User IDS via CSRF To Delete all Users with CSRF attack.

Security

2 min read

Dec 30, 2018

Abusing ACL Permissions to Overwrite other User’s Uploaded Files/Videos on s3 Bucket

Hi all, Today I am writing a blog about on a recent finding on HackerOne’s one of the program. I was looking for IDORs in an application so I started fuzzing each and every request of an application, I got mentioned request POST /api-2.0/s3-upload-signatures HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac…

Hackerone

4 min read

Abusing ACL Permissions to Overwrite other User’s Uploaded Files/Videos on s3 Bucket

Hackerone

4 min read

Sep 18, 2018

Chain The Bugs to Pwn an Organisation ( LFI + Unrestricted File Upload = Remote Code Execution )

Hi everyone, After completing my OSCP certification I thought to give a try to bug bounty, as OSCP has sharpened my exploitationSkills. I will use lol.com to represent an application as can not disclose the website’s name. While i was enumerating an application i got a domain which was basically…

Java Script

2 min read

Chain The Bugs to Pwn an Organisation ( LFI + Unrestricted File Upload = Remote Code Execution )

Java Script

2 min read

Feb 17, 2018

How i hacked my Internet Service Provider and automated the attack. ( Hacked to Learn)

I’ll be using victim.com as a site name in the article as i cannot disclose the name.It was a normal day and i was looking for some good internet plans as my current plan was ended. while i was checking the internet plans, my browser was hooked up with burp…

Hacking

3 min read

How i hacked my Internet Service Provider and automated the attack. ( Hacked to Learn)

Hacking

3 min read

Published in InfoSec Write-ups

·Sep 18, 2017

Chaining Self XSS with UI Redressing is Leading to Session Hijacking (PWN users like a boss)

while i was testing the web application i have found self xss. which has no impact. but i wanted to exploit this vulnerability, so have started thinking that how can i exploit this self xss, and then i have decided to chain the self xss with some other vulnerability. so…

Hacking

2 min read

Chaining Self XSS with UI Redressing is Leading to Session Hijacking (PWN users like a boss)

Hacking

2 min read

Published in InfoSec Write-ups

·Sep 17, 2017

Stealing User Details By Exploiting CORS

lets start with Cross Origin Resource Sharing. Below is the figure that how CORS works. i was hunting on a private site, at the content discovery time i was noticing every single requests and responses, at that time i have noticed that the application is using “Origin” header in the…

Java Script

2 min read

Stealing User Details By Exploiting CORS

Java Script

2 min read

Published in HackerNoon.com

·Sep 9, 2017

Bypassing Facebook Profile Picture Guard Security.

Facebook has recently introduced profile picture guard which which provides security against your profile picture and it also prevents security that your profile picture will not get misused. So here is the Policy of the Profile Picture guard that how it secures profile picture if you use profile picture guard.

Facebook

3 min read

Facebook

3 min read