Summary: When doing recon on Yahoo assets during Hackerone AWC 2023, I found a host foo.bar.yahoo.com. I thought it must be some internal tool for engineers, few pages are listed but clicking on any of the pages redirects to Okta SSO. I found a bug during black
Summary This bug allowed me to access a Management Information System Portal by bruteforcing common passwords. The admin panel allows changing theatre names, theatre status, changing ticket prices, user management, viewing system logs, etc. in South Asian countries. Reproduction Steps 1. Find all the ASNs owned by The Walt Disney
Hey everyone! Today, I am excited to share with you my insights into manual hacking. In this post, I will delve into hacking approaches, the reasons why I made the prefer manual hacking, discuss the mindset required for this approach and weigh its pros and cons. So, whether you are
Hi folks! I am Inderjeet Singh aka encodedguy. In this blog, I will write about parameter enumeration, its importance, and the automated/manual approach for enumerating parameters. Introduction A parameter in a URL is a string of characters that follows a question mark (?) within the URL. Parameters are used to