Have you ever found a vulnerability just by looking at the target source code? If not, let me tell you about my experience.

This discovery began when I examined my target’s source code for resources that might lead me to a vulnerability.

At that moment a code caught my attention, the code looked like this:

<!-- Custom Meta -->
        <meta name="DeviceType" content="desktop">
        <meta name="UserAgent" content="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.86 Safari/537.36">
        <meta name="IpAddress" content="182.x.xxx.xxx">
        <meta name="Rating" content="General">

You can see here that my user agent and IP are reflected in the source code.

then I immediately turned on Intercept burp suite to intercept requests and change my user agent valuethen I immediately turned on Intercept burp suite to intercept requests and change my user agent value.

But here I get 403 Forbidden when I change the user agent value to any string, for example: test, xxx, testing etc.

Not giving up at this point, I thought what if I changed my IP address to a payload ?
What I’m thinking about here to change the “IpAddress” value is to add an X-Forwarded-For: header, because I don’t think it’s possible to change my IpAddress to an Xss / html payload😂.

The X-Forwarded-For header is used to record the original IP address of clients accessing the server through a proxy or load balancer. For example:

X-Forwarded-For: 192.168.1.100, 10.0.0.1

This helps the server identify genuine clients for logging, security, or analysis. However, this header can be manipulated, so it must be used with caution.

Let’s try changing the IpAddress value by adding the X-Forwarded-For header.

After seeing that I could change the IpAddress value, of course what I thought was trying the htmli or xss payload.

The payload I use:
X-Forwarded-For: evil.com”><h1>okay</h1>

Maybe the developer only validates the userAgent value, not this one.
There are no character filters here even though this web application has waf installed (Cloudflare).

Let’s try Xss🔥

As I said, there are no character filters of any kind here, in stark contrast to the protection of the User-Agent value.

After getting all this I thought what if I try to read the internal file with the iframe tag?
After trying this idea I got nothing😥.

Lastly I tried ssrf using the iframe tag, but there’s nothing interesting here.

Payload : X-Forwarded-For: <iframe src=”http://burp-collaborator”>

After feeling this was enough, I immediately reported my findings to the web owner, and they responded well.

rewards? still being processed.

Maybe that’s all I can share this time, hopefully in the future I can share other interesting things.

X : Ghee1337
Telegram channels : https://t.me/bugbounty_reference

A few days ago I opened my email, and I saw a message from yeswehack containing an invitation to a bug bounty program (private program).

I immediately opened my laptop and accepted the invitation.
This program has many scopes, and the subdomains here are also included in their scope.

I chose scopes that accept vulnerabilities on their subdomains.
let’s just say the main domain is redacted.com because this is a private program.

The first step I took was subdomain enumeration, here I used subfinder to search.

After getting several subdomains, I selected several and opened them with a browser in Burp Suite. I did this so I could immediately see requests and responses via HTTP history via Burp Suite.

From this HTTP history, I started to analyze every request and response that I got, starting from parameters, login pages, and also javascript files.

This vulnerability started when I analyzed the JavaScript file and saw the ?back_url= parameter which was located in the application’s autologout function and I didn’t know about it before.

I immediately checked it by accessing it directly in my browser with a link like this: https://subdomain.redacted.com/users/sign_out?back_url=https://evil.com

quite happy when I found out that I was redirected to https://evil.com

after knowing that it was an open redirect vulnerability I tried to open it once again via the browser but this time I intercepted the request via burp suite and sent it to Repeater to check from this open redirect whether I can connect it to other vulnerabilities, Xss for example?

But after trying to use several xss payloads, html injection and others I can’t increase the impact because some characters are filtered :)

What’s even sadder is that after I reported this vulnerability it turned out my report was marked as a duplicate and I only got points :(

Maybe that’s all I can share this time, hopefully in the future I can share other interesting things.

X : Ghee1337
Telegram channels : https://t.me/bugbounty_reference

The discovery of this vulnerability began when I visited an e-commerce website.
At first I just did normal testing for fun like Idor, XSS, information disclosure etc.

But I haven’t found Idor or XSS there, maybe I’m not careful enough.

Then I tried adding any product to my cart just to find out how the purchasing process works, I hoped to find information disclosure or IDOR here but there was nothing interesting.

When I got to the payment point I saw that we could use a coupon code to get a discount, I didn’t think long and immediately tested it to find something interesting.

I tried using code “test” for testing and intercepting requests using burp suite.

More or less like this is the request and response :

Of course the “test” coupon code is not valid because it is only for my testing.
Then I added ‘ to check if it is vulnerable to sql injection.

I was quite pleased when I saw the coupon code response “test‘’” which told me that the function was vulnerable to SQL injection attacks.

Because I saw that there was no waf protection on this web application, I copied the request and saved it into the req.txt file for automation using sqlmap.

After waiting a while for SqlMap to complete its analysis, I was quite satisfied with the results, because I knew that the coupon code function was indeed vulnerable to SQL injection.

sqlmap command that I use :

python2 sqlmap.py -r req.txt --random-agent --tamper=space2comment --level=5 --risk=3 --no-cast -p coupon --dbs

Do I get a bounty for this?
I didn’t expect more, because this is not a bug bounty program like the ones from hackerone, yeswehack or bugcrowd.

But after seeing that this e-commerce website was quite large with thousands of followers on X, Facebook, Instagram and also TikTok, I decided to report it via the email I got on the contact us page.

Until now there has been no reply from the team regarding my report :)

Maybe this is the only short story I can share, I still have several drafts of interesting articles that I haven’t published because I’m still waiting for confirmation from the team.

So don’t forget to follow me.

X : Ghee1337
Telegram channels : https://t.me/bugbounty_reference

Halo Semua, Senang bisa berbagi dengan kalian semua kembali…
Pada sesi kali ini saya akan sharing tentang bagaimana cara menyelesaikan tantangan ctf OverTheWire Bandit Level 0 to Level 10.

BANDIT0

Pertama kalian buka : https://overthewire.org/wargames/bandit/bandit0.html

Lalu kalian remote ssh dengan credential yang sudah ada pada laman bandit0 di atas ,seperti ini :

ssh bandit0@bandit.labs.overthewire.org -p 2220

Username : bandit0
Password : bandit0

Disini saya anggap kalian sudah memahami basic command Linux/Bash

Jika sudah masuk pada server melalui ssh ,lanjut kalian ketikan saja ls setiap pertama kali kalian selesai masuk ke ssh tersebut.
maka kalian akan melihat file bernama “readme”.
kalian buka atau lihat file itu dengan command cat :
$cat readme

bandit0@bandit:~$ ls
readme
bandit0@bandit:~$ cat readme
Congratulations on your first steps into the bandit game!!
Please make sure you have read the rules at https://overthewire.org/rules/
If you are following a course, workshop, walthrough or other educational activity,
please inform the instructor about the rules as well and encourage them to
contribute to the OverTheWire community so we can keep these games free!

The password you are looking for is: ZjLjTmM6FvvyRnrb2rfNWOZOTa6ip5If

Jadi challenge OverTheWire Bandit dari level 0–10 adalah kalian di haruskan mencari password untuk masuk ke ssh/user berikutnya ,contoh bandit0, bandit1, bandit2 ,bandit3 dan seterusnya.

Setelah mendapatkan password dari file readme pada user bandit0 ,kalian exit saja dan masuk kembali namun sekarang berganti ke user bandit1 ,untuk username dan password nya adalah bandit1 ( sesuai level ) dan passwordnya adalah tulisan yang saya beri garis tebal :
The password you are looking for is: ZjLjTmM6FvvyRnrb2rfNWOZOTa6ip5If

BANDIT1

Lanjut login ke ssh bandit1 dengan credential yang sudah kalian dapatkan :

ssh bandit1@bandit.labs.overthewire.org -p 2220

bandit1@bandit:~$ ls
-
bandit1@bandit:~$ lsattr
 — — i — — — — -e — — — — ./-
bandit1@bandit:~$ cat ./-
263JGJPfgU6LtdEvgfWU1XP5yac29mFx

BANDIT2

lanjut saja ke bandit2 ,karena disini masih basic jadi saya tidak akan menjelaskannya ,agar kalian bisa memperlajarinya lagi:b

ssh bandit2@bandit.labs.overthewire.org -p 2220
bandit2@bandit:~$ ls
spaces in this filename
bandit2@bandit:~$ cat “spaces in this filename”
MNk8KNH3Usiio41PRUEoDFPqfxLPlSmx

kenapa disini saya menggunakan tanda titik dua untuk melihat file tersebut ? karena jika kita langsung melakukan command cat seperti pada umumnya pasti akan error karena terdapat space pada nama file tersebut :
bandit2@bandit:~$ cat spaces in this filename
cat: spaces: No such file or directory
cat: in: No such file or directory
cat: this: No such file or directory
cat: filename: No such file or directory

BANDIT3

ssh bandit3@bandit.labs.overthewire.org -p 2220

bandit3@bandit:~$ ls
inhere
bandit3@bandit:~$ cd inhere
bandit3@bandit:~/inhere$ ls
bandit3@bandit:~/inhere$ ls -all
total 12
drwxr-xr-x 2 root root 4096 Jul 17 15:57 .
drwxr-xr-x 3 root root 4096 Jul 17 15:57 ..
-rw-r — — — 1 bandit4 bandit3 33 Jul 17 15:57 …Hiding-From-You
bandit3@bandit:~/inhere$ cat …Hiding-From-You
2WmrDFRmJIq3IPxneAaMGhap0pFhF3NJ

Disini masih cukup mudah ,karena hanya hidden file yang masih bisa dibuka dengan basic command [ ls -all ] / ( tanpa proteksi ).

BANDIT4

ssh bandit4@bandit.labs.overthewire.org -p 2220
bandit4@bandit:~$ ls
inhere
bandit4@bandit:~$ cd inhere
bandit4@bandit:~/inhere$ ls
-file00 -file01 -file02 -file03 -file04 -file05 -file06 -file07 -file08 -file09
bandit4@bandit:~/inhere$ file ./-file0*
./-file00: data
./-file01: data
./-file02: data
./-file03: data
./-file04: data
./-file05: data
./-file06: data
./-file07: ASCII text
./-file08: data
./-file09: data
bandit4@bandit:~/inhere$ cat ./-file07
4oQYVPkxZOOEOO5pTW81FB8j8lxXGUQw

Disini karena ada banyak file yang mempunyai kemiripan pada nama filenya maka kita menggunakan tanda bintang (*) untuk melihat jenis file tersebut , sebenernya bisa saja kita melihatnya satu persatu ,tapi apakah itu tidak memakan waktu ?

BANDIT5

ssh bandit5@bandit.labs.overthewire.org -p 2220

bandit5@bandit:~$ ls
inhere
bandit5@bandit:~$ cd inhere
bandit5@bandit:~/inhere$ ls
maybehere00 maybehere03 maybehere06 maybehere09 maybehere12 maybehere15 maybehere18
maybehere01 maybehere04 maybehere07 maybehere10 maybehere13 maybehere16 maybehere19
maybehere02 maybehere05 maybehere08 maybehere11 maybehere14 maybehere17
bandit5@bandit:~/inhere$ find -type f -size 1033c ! -executable
./maybehere07/.file2
bandit5@bandit:~/inhere$ cat ./maybehere07/.file2
HWasnPhtq9AVKe0dmk45nxy20cvUa6EG

Disini kalian akan melihat banyak file dan juga directory yang mana jika kalian mencari password untuk masuk ke user bandit6 dengan cara mengecek file dan juga directory” tersebut satu persatu maka akan memakan waktu yang lumayan ,untungnya linux mempunyai command find :

find -type f -size 1033c ! -executable

find: Perintah ini digunakan untuk mencari file atau direktori dalam sistem file berdasarkan kriteria tertentu.
-type f: Flag ini menginstruksikan find untuk mencari file reguler (bukan direktori atau jenis file lain).
-size 1033c: Opsi ini digunakan untuk mencari file dengan ukuran tepat 1033 byte (c adalah singkatan dari “characters”, yang merupakan ukuran dalam byte).
! -executable: Operator ! membalikkan hasil pencarian, jadi ini akan mencari file yang tidak dapat dieksekusi.
Jadi, perintah ini mencari semua file reguler yang ukurannya tepat 1033 byte dan tidak memiliki izin eksekusi.

./maybehere07/.file2

Ini merujuk pada file atau direktori dengan path relatif ./maybehere07/.file2. Path ini menunjukkan bahwa .file2 berada dalam direktori maybehere07, yang berada di direktori saat ini (. menunjukkan direktori saat ini).

BANDIT6

ssh bandit6@bandit.labs.overthewire.org -p 2220

bandit6@bandit:~$ ls
bandit6@bandit:~$ find / -user bandit7 -group bandit6 -size 33c 2>&1 | grep -F -v Permission | grep -F -v directory
/var/lib/dpkg/info/bandit7.password
bandit6@bandit:~$ cat /var/lib/dpkg/info/bandit7.password
morbNTDkSW6jIlUc0ymOdMaLnOlFVAaj

Kenapa kita menggunakan command find lagi pada bandit6 ? jawabannya adalah karena directory utama kita tidak terdapat file apapun kecuali file bawaan dari linux ,seperti .bashrc .profile dll ,maka dari itu kita menggunakan command find kembali untuk mencari file / password user bandit 7 ,berikut penjelasannya :

find / -user bandit7 -group bandit6 -size 33c

find: Perintah ini digunakan untuk mencari file atau direktori dalam sistem file.
Direktori root (/) digunakan sebagai lokasi awal pencarian, yang berarti pencarian akan dilakukan di seluruh sistem file.
-user bandit7: Menyaring pencarian untuk file yang dimiliki oleh pengguna bandit7.
-group bandit6: Menyaring pencarian untuk file yang grup pemiliknya adalah bandit6.
-size 33c: Menyaring pencarian untuk file yang ukurannya tepat 33 byte (c adalah singkatan dari “characters”, yang berarti ukuran dalam byte).
Perintah ini mencari file di seluruh sistem yang dimiliki oleh pengguna bandit7, dengan grup pemilik bandit6, dan berukuran tepat 33 byte.

2>&1

Ini adalah pengalihan output. 2 mewakili aliran error standar (stderr), dan 1 mewakili aliran output standar (stdout).
2>&1 mengalihkan stderr ke stdout, yang berarti error yang muncul selama proses pencarian akan digabungkan dengan output normal (stdout).
grep -F -v Permission

Ini adalah pipe yang mengarahkan output dari perintah sebelumnya (find) ke perintah berikutnya (grep).
grep: Perintah ini digunakan untuk mencari teks dalam output.
-F: Menginstruksikan grep untuk mencari teks secara literal, bukan sebagai pola regex.
-v: Menginstruksikan grep untuk membalikkan pencarian, yang berarti akan menampilkan semua baris kecuali yang cocok dengan pola.
Permission: Kata ini adalah pola yang dicari oleh grep.
Bagian ini menyaring hasil pencarian dengan menghilangkan baris yang mengandung kata “Permission”. Ini biasanya digunakan untuk mengabaikan pesan error terkait masalah izin (permission denied).

grep -F -v directory

Pipe ini mengarahkan output dari perintah sebelumnya (grep -F -v Permission) ke perintah berikutnya (grep).
grep -F -v directory: Ini menyaring hasil pencarian lebih lanjut dengan menghilangkan baris yang mengandung kata “directory”. Ini berguna untuk mengabaikan direktori dari hasil pencarian.

BANDIT7

ssh bandit7@bandit.labs.overthewire.org -p 2220

bandit7@bandit:~$ ls
data.txt
bandit7@bandit:~$ cat data.txt | grep millionth
millionth dfwvzFQi4mU0wfNbFOe9RoWskMLg7eEc

Di user bandit7 kita diberi file data.txt yang isinya banyak sekali ,tidak mungkin kita menebak-nebaknya ,karena itu kita menggunakan command grep di belakanya untuk memfilter mana password yang benar.
lalu dari mana saya mendapatkan keyword / kata “millionth”.

Sebenarnya Semua penjelasan saya tadi sudah ada pada setiap halaman website https://overthewire.org/wargames/bandit/bandit(*).html

mulai dari command apa saja yang dibutuhkan apa clue nya dll.

BANDIT8

ssh bandit8@bandit.labs.overthewire.org -p 2220

bandit8@bandit:~$ ls
data.txt
bandit8@bandit:~$ cat data.txt | sort | uniq -c -u
1 4CKMh1JI91bUIZZPXDqGanal4xvAg0JM

Tidak perlu ditanyakan lagi mengapa saya menggunakan command sort dan juga uniq ,karena saya sudah mendapatkan clue dari laman challenge bandit8 ,disitu dijelaskan command” apa saja kah yang bisa saya gunakan untuk mendapatkan flag/passwordnya ,dalam kasus ini saya menggunakan command sort dan juga uniq ,berikut daftar perintah yang bisa kalian gunakan sesuai pada laman bandit8 :

grep, sort, uniq, strings, base64, tr, tar, gzip, bzip2, xxd

BANDIT9

ssh bandit9@bandit.labs.overthewire.org -p 2220
bandit9@bandit:~$ ls
data.txt
bandit9@bandit:~$ strings data.txt | grep ====
\a!;========== the
========== passwordf
========== isc
========== FGUW5ilLVJrxX9kMYMmlN4MgbpfMiqey

disini kalian bisa menggunakan command selain strings ,contoh :

grep, sort, uniq, strings, base64, tr, tar, gzip, bzip2, xxd

kalian hanya perlu menyesuaikan commandnya sesuai kebutuhan kalian:b

BANDIT10

ssh bandit10@bandit.labs.overthewire.org -p 2220
bandit10@bandit:~$ ls
data.txt
bandit10@bandit:~$ cat data.txt
VGhlIHBhc3N3b3JkIGlzIGR0UjE3M2ZaS2IwUlJzREZTR3NnMlJXbnBOVmozcVJyCg==

Pada clue bandit10 ini justru malah mudah ,karena terlihat jelas bahwa isi dari file data.txt adalah base64 ,kalian hanya perlu men decode kannya ,disini saya men decodekannya menggunakan tools dari situs web : https://www.base64decode.org/

dan ini dia hasilnya :
The password is dtR173fZKb0RRsDFSGsg2RWnpNVj3qRr

Selesai sudah OverTheWire Bandit Level 0 to Level 10 Challenge.

Thanks you for reading my simple article:)

The first thing you need to know before installing Linux on Virtual Box is the minimum specifications required for installation :

Ram Minimum : 4 Gb
Hard Disk : Minimal 30 GB
System Operation Host : Windows, macOS, Linux, atau Solaris

Here I will not explain what Kali Linux is and what virtual box is, because by opening or reading this article I hope you already know it.

The first thing you need to prepare is the Kali Linux ISO file which you can get on the official Kali Linux website : https://www.kali.org/get-kali/#kali-platforms

Because here we are installing it in a virtual box (not dual boot) so you can choose the Kali Linux installer file, and adjust it to the operating system you are using, here I am using 64 bit.

If you have finished downloading the Kali Linux ISO file, continue downloading Virtual Box at the following address : https://www.virtualbox.org/wiki/Downloads
Adapt it to the operating system you are using, and don’t forget to download the latest version so you don’t get bugs/differences with the one I use.

If you have downloaded the Kali Linux and Virtual Box ISO files, follow my steps below.

1. Open Virtual Box and click the New button in the top left corner.

-In the Name section you can name it freely, for example here I named Kali Linux.
-Folder You can select the drive you want to use for installing Kali Linux.
-Now in the ISO Image section, you select the .iso file that you downloaded earlier.
-For the type, you can choose Linux, and the version here I choose Debian (64-bit)

• You can just skip the Unattended Install section.
  -Then in the Hardware Menu you can drag a line from left to right until the green color is complete, whether it is on the base memory or processors,
  And on Enable EFI you can just uncheck it.

• After that, in the Hard Disk section, you can adjust the capacity of your hard disk, because here the laptop I use has quite a high capacity, so I use 80GB of my hard disk, just adjust it okay.
  -For the type and variant, you can choose VDI.
  -Then click Finish

-Next, you just need to click Start (top right green button)
And wait until Bios Mode appears.
-When it appears, select Graphical Install and click Enter.
-Select the language you want (here I chose English)
-For the location and so on, you can adjust it yourself according to your wishes, I won’t explain it in detail here because it will take up a lot of space in this article, after all, you have already chosen the language you can, right?

After that, click continue and when you are on the “Configure The Network” menu:
In the hostname section, just enter the hostname you want, for example (Kali-Linux).
For domains, fullnames, usernames are also the same as hostnames (just adjust according to your wishes.

Now, when you arrive at the setup users and passwords menu, you can enter the password you want to use to log into your Kali Linux account with the username you created earlier.
For your time zone, just choose according to the area where you are, it’s free, no problem.

When you reach the Partition Disks menu, just select the top one (Guide — Use entire disk) then click continue again.
Next you will be asked to select a disk partition, just select All files in one partition (Recommended For New Users) click continue again.
If the yes or no option appears, just select yes and continue again.

So, for the default software here, you are actually free to choose which one you want, but here, because I prefer the GNOME appearance, I checked the GNOME section too.
GRUB Boot loader, just select yes and continue again. If you are asked to select the GRUB boot loader device, just click continue again.
Wait a few moments until the installation process is complete.
If the installation process is complete, it will look like this:

You just click on the username you created earlier and enter the password you created earlier, then enter…

And Finish..
That’s enough from me, I hope it helps a little for all of you, if you have any questions, don’t hesitate to comment🥱…

@merdekasiberacademy
#cara #merdekasiberacademy #ethicalhacking #hacking #bugbounty #blackhat
#whitehat