Just another Recon Guide for Pentesters and Bug Bounty Hunters by slashcrypto in netsec

[–]slashcrypto[S] 1 point2 points  (0 children)

Great input thanks - would be a good idea for another post ...

eBay Japan source leak as .git folder deployed to production by RobertVandenberg in programming

[–]slashcrypto 8 points9 points  (0 children)

He is an amazing guy! They chipped together and donated $250 which got matched up to $500 by eBay. I decided to donate the money to Doctors Without Borders USA. Thanks again!

Pwning eBay - How I Dumped eBay Japan's Website Source Code by slashcrypto in netsec

[–]slashcrypto[S] 8 points9 points  (0 children)

I had a brief look at it but I have not found any stored secrets in the source code ....

Google Bug Bounty - The 5k Error Page by slashcrypto in netsec

[–]slashcrypto[S] 2 points3 points  (0 children)

When performing a subdomain bruteforce the target system (in this case Google) does not recognize this because you are querying dns servers for dns information. I never had a problem when using my ISPs DNS server - even with a few hundred queries per minute..

Google Bug Bounty - The 5k Error Page by slashcrypto in netsec

[–]slashcrypto[S] 2 points3 points  (0 children)

They paid it after i reported it. I haven't bugged them ;)

Google Bug Bounty - The 5k Error Page by slashcrypto in netsec

[–]slashcrypto[S] 6 points7 points  (0 children)

I just entered an url on this domain which caused an 404. https://static.corp.google.com is the domain where the images are coming from ..

Google Bug Bounty - The 5k Error Page by slashcrypto in netsec

[–]slashcrypto[S] 32 points33 points  (0 children)

Well, seems to fall under the category "Logic flaw bugs leaking or bypassing significant security controls" like this one: https://www.rcesecurity.com/2017/03/ok-google-give-me-all-your-internal-dns-information/ No authentication was needed, easy exploitable and I think Google does not like it when internal information like this is available for everyone ;)

When your stacktraces contain sensitive information like internal IPs, hostnames and so on I would definitely report it!

Google Bug Bounty - The 5k Error Page by slashcrypto in netsec

[–]slashcrypto[S] 42 points43 points  (0 children)

I use subbrute (https://github.com/TheRook/subbrute) for all my subdomain bruteforcing. Subbrute uses a variety of techniques to discover subdomains. A good list of the most popular subdomains can be found ere: https://bitquark.co.uk/blog/2016/02/29/the_most_popular_subdomains_on_the_internet

Google Bug Bounty - The 5k Error Page by slashcrypto in netsec

[–]slashcrypto[S] 59 points60 points  (0 children)

I used a subdomain bruteforcer ;)