Sign in Subscribe

Inderjeet Singh

jsmon-cli - Enhanced Security Tooling for JavaScript (jsmon.sh)

A fast and convenient tool (API client) for your JS security tasks powered by jsmon.sh. What is jsmon-cli? A command-line interface designed to act as an API client for jsmon.sh. Whatever you can do at the webapp, most of these features can be used via jsmon-

How I Got Multiple Privilege Escalations - The Easy Trick?

Hello hackers! Today, I'll describe a way through which I got multiple privilege escalations. Background: It's a vast application with tenants and user roles. For testing basic privilege escalations first, I created two accounts: admin user and least privilege user. Least privilege user is the user

Soft Deletion of Resources - [Privacy Violation]

Introduction Soft deletion is the process of showing that an entry is removed but not actually removed from the databases. Is it GDPR compliant? No. As per GDPR (General Data Protection Regulation), unauthorized access and unlawful processing of personal data protection must be there. I am Inderjeet Singh aka encodedguy,

API Excessive Data Exposure: Why Devs? Why?

API Excessive Data Exposure When the API sends extra response to the client than required, it is called as API Excessive Data Exposure. In layman's terms, client wants x but API sends x+y. Is x+y a bug? I am not saying x+y is a bug,

5500$ Bug Story - Ezzy 2FA Bypass

Summary: A payment application requires 2FA verification by your number and email both when editing user details including name, email or phone number. I found an easy bypass for the implemented 2FA flow through which an attacker can edit the user details without his phone/email access that finally leads

Default OTP: Account Takeover

Summary Attacker can login into any account by entering their phone number and confirmation OTP 1234. The target was not in production, 1234 must be hardcoded or used as a default OTP. Reproduction Steps 1. Go to foo.bar.target.com and click on Login. 2. Enter your phone number.

Bypassing Okta SSO=> HTTPS/HTTP

Summary: When doing recon on Yahoo assets during Hackerone AWC 2023, I found a host foo.bar.yahoo.com. I thought it must be some internal tool for engineers, few pages are listed but clicking on any of the pages redirects to Okta SSO. I found a bug during black

Pwning Admin Panel To Change Movie Ticket Prices at Disney

Summary This bug allowed me to access a Management Information System Portal by bruteforcing common passwords. The admin panel allows changing theatre names, theatre status, changing ticket prices, user management, viewing system logs, etc. in South Asian countries. Reproduction Steps 1. Find all the ASNs owned by The Walt Disney

Slides: GraphQL Hacking

[1->2->3] or [2->3]: Bypassing Authentication Barriers

Hey Hackers!! I am Inderjeet aka encodedguy, today I will explain how to bypass the authentication barriers or verification checks for sensitive features. Sensitive Features Many applications have this button that says "Delete your data", "Download your data", "Pay Now", etc. The sensitive feature