vict0ni.me

Taking over accounts in multiple ways

With my invitation to renniepak's HackerHideout, I got the chance to re-live the bug bounty/hunting thrill that I hadn't felt for some time. I haven't bug hunted for quite a while, so I decided to write a small post about two recent findings that could lead to an account

On the hunt for data leaks: Elastic(search²)

[BSides Athens 2024 tool presentation slides.] Stretching the Boundaries Hunting for Elasticsearch Leaks1 Stretching the Boundaries_ Hunting for Elasticsearch Leaks(1).pptx 1 MB .a{fill:none;stroke:currentColor;stroke-linecap:round;stroke-linejoin:round;stroke-width:1.5px;}download-circle Since October 2023, I've discovered more than 10M PII of people and helped

Sensitive documents of 75 million Indian residents exposed [by Jagmeet Singh @ TechCrunch]

Article written by Jagmeet Singh for TechCrunch after my finding report about a bug in Rajasthan's portal that allowed access to Janaadhaar's applicants' documents.

Discovering Intelligence Agency Leaks [by Matt Burgess @ WIRED]

Article written by Matt Burgess for WIRED after my finding about the leaks of a Bangladeshi SIGINT agency.

Millions of Chinese citizen IDs exposed [by Zack Whittaker @ TechCrunch]

Article written by Zack Whittaker for TechCrunch after my finding report of more than 2 million citizen IDs leaking from a Chinese e-commerce store.

Web Vulnerabilities and Disclosure Revelations: The Ship Has Sailed

This is the first article of the series. It's a pretty cool bug, in my opinion, with a little twist at the end. As we progress, there will be more high- (and low-) profile exposures and issues. Lately, I've given a lot of focus on APIs. I've been researching ways

Uncovering ~50 million Bangladeshi citizen records [by Lorenzo Franceschi-Bicchierai @ TechCrunch]

Article written by Lorenzo Franceschi-Bicchierai for TechCrunch after my finding report of more than 50 million citizen records leaking from a governmental Bangladeshi system.

Bypassing the IPinfo API (feat. pry0cc)

Around October 2020, I was pretty active in the bug hunting community. And of course, I was hunting too, as a form of training and learning process. Around that time, my friend @pry0cc made a utility named ipi As explained in the README file, this utility was based on the

CVE

Redwood Report2Web XSS and Frame Injection

Report2Web v4.3.4.5 and v4.5.3 are vulnerable to XSS. v4.3.4.5 is also vulnerable to frame injection. Both issues are fixed in v4.6.0. Report2Web Login Panel XSS - CVE-2021-26710The value of the urll parameter is getting reflected without any sanitization, allowing a

Bug Bounty

Using search engines for fun and bounties

Passive reconnaissance plays an important role in the approach of a target. In comparison to active reconnaissance, passive reconnaissance is the silent, stealthy one, where the attacker doesn't interact with the target. Instead, they obtain target information based on external, third-party sources. Such a source is search engines. In the

IDOR leads to Data leakage and Profile Update

In another bug bounty session of mine, I came across a bounty program of a “Contract Review” company. In their web app, one could register with a first/last name, an email and their company’s name (and a password ofc)...