K?t h?p Open Redirect trong vi?c khai th�c l? h?ng b?o m?t

K?t h?p Open Redirect trong vi?c khai th�c l? h?ng b?o m?t

open redirect Vulnerability Write-up xss

Ch��ng tr?nh Bug Bounty c?a Google (VRP) th�?ng xuy�n nh?n ��?c c�c b�o c�o l?i c� �? c?p t?i open redirect (chuy?n h�?ng m?). M?c d� b?n th�n ch�ng kh�ng ��?c xem x�t l� l? h?ng b?o m?t, ch�ng t�i nh?n ra r?ng open redirect c� th? ��?c s? d?ng �? khai th�c c�c l? h?ng kh�c nh� XSS ho?c OAuth Token Disclosure.
Read More

Unknown Pada 15:26 Komentar

X �? �? l? th�ng tin c� nh�n c?a 3 tri?u ng�?i d�ng nh� th? n�o?

X �? �? l? th�ng tin c� nh�n c?a 3 tri?u ng�?i d�ng nh� th? n�o?

Information Disclosure J2TeaM Write-up

L?i m? �?u: Trong l�c trao �?i v? vi?c c�ng b? b�i vi?t chi ti?t th? t�i �? nh?n l?i v?i b�n X l� s? kh�ng ch? ��ch danh m?t c�ng ty, t? ch?c n�o trong b�i n�y. D� sao th?, nh?ng tr?i nghi?m th?c t? trong vi?c ph�n t�ch v� truy t?m hung th?... � nh?m, truy t?m l? h?ng m?i l� nh?ng th? gi� tr? nh?t m� t�i mu?n chia s? v?i c�c b?n. V?y n�n m?t c�i t�n g?i th? ��u c� g? qu� quan tr?ng ��ng kh�ng n�o?!
Read More

Unknown Pada 05:44 Komentar

Mr. Robot Session 2 - easter eggs | S�n tr?ng ph?c sinh #2

Mr. Robot Session 2 - easter eggs | S�n tr?ng ph?c sinh #2

Tutorials Write-up

Cu?i t?p 8 - Mr. Robot session 2, khi Darlene nh?n v�o m�n h?nh laptop �? theo d?i �o?n chat. Ch�ng ta nh?n th?y m?t �?a ch? website: https://i246.bxjyb2jvda.net

Truy c?p v�o trang n�y th? ch? th?y d?ng ch? "i246.bxjyb2jvda.net"
Read More

Unknown Pada 12:33 Komentar

Mr. Robot Session 2 - easter eggs | �i s�n tr?ng ph?c sinh trong Mr. Robot

Mr. Robot Session 2 - easter eggs | �i s�n tr?ng ph?c sinh trong Mr. Robot

Tutorials Write-up

? cu?i t?p m?t c?a Mr. Robot Session 2, c� c?nh khi Darlene t?o m? �?c t?ng ti?n (ransomeware) b?ng b? c�ng c? SET. H?y ch� ? v�o �?a ch? IP 192.251.68.254, ��y c� v? nh� l� m�y ch? �i?u khi?n (C&C) c?a con malware n�y. Ch�ng ta c�ng xem n� ?n ch?a �i?u g? �?c bi?t n�o!
Read More

Unknown Pada 16:13 Komentar

T�i �? hack VietDesigner.net v� Kenhsinhvien.vn nh� th? n�o?

T�i �? hack VietDesigner.net v� Kenhsinhvien.vn nh� th? n�o?

CSRF Write-up xss

H�nh tr?nh truy t?m l? h?ng b?o m?t

Tr�?c h?t, t? xem x�t �?c �i?m chung c?a c? hai trang web n�y:

1. ��y �?u l� 2 di?n ��n l?n (m?c ti�u c�ng l?n, c�ng nhi?u ng�?i d�ng th? c�ng t? l? thu?n v?i s? nguy hi?m c?a m?t l?i b?o m?t ��?c ph�t hi?n).
2. C�ng s? d?ng n?n t?ng Xenforo.
3. C�ng s? d?ng m?t add-on gi?ng nhau �? t?o tr?nh chuy?n h�?ng li�n k?t.

Trong 3 �?c �i?m n�y th? �i?u th? 3 ch�nh l� m?u ch?t:

• http://kenhsinhvien.vn/redirect/?url=https://junookyo.blogspot.com/
• http://forum.vietdesigner.net/redirect/?url=https://junookyo.blogspot.com/

T?i sao t? bi?t r?ng 2 trang c�ng d�ng m?t add-on? Ngo�i vi?c d?a theo c?u tr�c li�n k?t, th? t? xem m? ngu?n trang chuy?n h�?ng c?a c? 2 v� c�ng m?t th?y t? kh�a quan tr?ng sau:

T?m t? kh�a �� tr�n Google:

Nh� v?y c� th? �o�n ��?c 2 di?n ��n kia �ang s? d?ng add-on t?o tr?nh chuy?n h�?ng t�n l� "GoodForNothing Url Anonymizer" (sau n�y �? �?i t�n th�nh GoodForNothing Link Proxy).
Read More

Unknown Pada 05:45 Komentar

T�i �? hack phimmoi.net nh� th? n�o? - Ph?n 2

T�i �? hack phimmoi.net nh� th? n�o? - Ph?n 2

J2TeaM Path Disclosure Write-up xss

H�m nay v?a ��ng m?t tu?n t�nh t? ng�y t? hack phimmoi.net (24/06), ch? sau �� hai ng�y - 26/06, t? ti?p t?c ph�t hi?n ra 2 l? h?ng b?o m?t ti?p theo thu?c sub-domain c?a phimmoi.net

C�u chuy?n b?t �?u

Ng�y 26/06, trong l�c v�o xem phim t?i phimmoi, t? ch?t �? ? c�i banner qu?ng c�o ? c?t b�n ph?i. V? �ang s? d?ng uBlock n�n t? kh� ng?c nhi�n khi th?y v?n c� m?t banner hi?n th?.

T? li?n nh?n ph?i chu?t v�o banner v� sao ch�p li�n k?t:

http://uniad.phimmoi.net/publisher/go/?bannerid=673&zoneid=3&dtime=1467368202&ctype=CPD&domain=phimmoi.net&verify=fe8043c8f4e38373918ba129a804b5d4&href=http%3A%2F%2Fcuuam.360game.vn%2Fintro%2Fcackpg3%2Flanding%2Findex.html%3Futm_source%3DBanner%26utm_medium%3DPhimmoi.net%26utm_content%3DPhimmoi.net_PlayerPage_Right1_300x600

S? d?ng t�nh n�ng Split URL (ng?t c�c tham s?) v� URLdecode c?a Hackbar:

http://uniad.phimmoi.net/publisher/go/
?bannerid=673
&zoneid=3
&dtime=1467368202
&ctype=CPD
&domain=phimmoi.net
&verify=fe8043c8f4e38373918ba129a804b5d4
&href=http://cuuam.360game.vn/intro/cackpg3/landing/index.html?utm_source=Banner&utm_medium=Phimmoi.net&utm_content=Phimmoi.net_PlayerPage_Right1_300x600

V? l� URL c?a m?t banner qu?ng c�o n�n hi?n nhi�n ��y l� m?t tr?nh chuy?n h�?ng li�n k?t. Sau khi th?c hi?n ch�t nghi�n c?u nh?, t? ph�t hi?n ra trong c�c tham s? c?a URL th? ch? c� tham s? href l� b?t bu?c (required). Nh� v?y, t? ho�n to�n c� th? l?i d?ng tr?nh chuy?n h�?ng n�y �? tr? t? b?t c? li�n k?t n�o t? mu?n. V� d?:

http://uniad.phimmoi.net/publisher/go/?href=https://junookyo.blogspot.com
Read More

Unknown Pada 07:47 Komentar

T�i �? hack trang SinhVienIT.net nh� th? n�o?

T�i �? hack trang SinhVienIT.net nh� th? n�o?

CSRF Write-up xss

L? h?ng b?o m?t XSS tr�n sinhvienit.net

M?t ng�y �?p tr?i, t? l�n Google ki?m link t?i Visual Studio. Nh� th�?ng l?, SVIT (sinhvienit.net) v� VNZ (vn-zoom.com) lu�n �?ng top khi t?m ki?m m?y ph?n m?m... cr@ck. Kh?i ph?i suy ngh?, t? li?n nh?n v�o m?t link c� th? tin t�?ng (l� trang n�o th? c�c b?n c?ng bi?t r?i �?y, li�n quan t?i b�i vi?t m�).
Read More

Unknown Pada 05:52 Komentar

Facebook bug - x�a b?t k? video n�o tr�n Facebook

Facebook bug - x�a b?t k? video n�o tr�n Facebook

FaceBook Vulnerability Write-up

V�o ng�y 10/06/2016 v?a qua, Pranav Hivarekar - m?t nh� nghi�n c?u b?o m?t �? ph�t hi?n ra m?t l? h?ng trong t�nh n�ng m?i c?a Facebook l� b?nh lu?n b?ng video.

C�u chuy?n ph�a sau

T�i v� t?nh l�?t qua ghi ch� "New: Videos in Comments!" vi?t b?i Bob Baldwin - m?t k? s� l�m vi?c t?i Facebook. Ghi ch� n�y vi?t v? vi?c Facebook tung ra t�nh n�ng m?i b?nh lu?n v?i video. VD: gi? ��y, ng�?i d�ng ��?c ph�p t?i l�n m?t video trong b?nh lu?n.
Read More

Unknown Pada 19:17 Komentar

T�i �? hack phimmoi.net nh� th? n�o?

T�i �? hack phimmoi.net nh� th? n�o?

J2TeaM Write-up xss

1. Nghi ng? v? l? h?ng XSS tr�n phimmoi.net

�ang ng?i code th? �ng anh g?i cho c�i link phim k�u v�o coi, ban �?u c?ng kh�ng mu?n coi ��u v? th?y IMDB th?p qu�. M� sau �ng ? g?i th�m c�i link Youtube n�y n?a n�n m?nh thay �?i ? �?nh li?n.

Read More

Unknown Pada 07:08 Komentar

phimmoi.net - Bug nh? trong trang download

phimmoi.net - Bug nh? trong trang download

JavaScript PHP Write-up

T?nh h?nh l� trong l�c v�o t?i phim t?i phimmoi.net th? t�i v� t?nh ph�t hi?n ra c�i bug n�y, th�?ng g?p ph?i khi k?t h?p gi?a PHP v� JSON/JS �? t?o n?i dung �?ng.

Read More

Unknown Pada 15:32 Komentar

T�i �? hack Kickstarter v� AirBnb nh� th? n�o?

T�i �? hack Kickstarter v� AirBnb nh� th? n�o?

FaceBook Tutorials Write-up

M?i chuy?n b?t �?u t? n?m 2013 trong qu� tr?nh x�y d?ng ch?c n�ng login v?i Facebook, t�i �? t?m ra m?t c�ch �? t?n c�ng v�o c�c h? th?ng login v?i Facebook kh�c. �? ch?ng minh ph��ng ph�p t?n c�ng c?a m?nh l� hi?u qu?, t�i c� test th? ph��ng ph�p n�y v?i kh� nhi?u ?ng d?ng kh�c, v� k?t qu? l� r?t nhi?u ?ng d?ng g?p l?i t��ng t?. Hai ?ng d?ng ph? bi?n nh?t trong s? �� l� AirBnB v� Kickstarter.
Read More

Unknown Pada 01:24 Komentar