www.1337.or.id

Search: microsoft

Microsoft says hackers attacking energy grids using decades-old software

Microsoft says hackers attacking energy grids using decades-old software

Ganesha   25 November 2022   24.564 Views
Microsoft said this week that technology discontinued in 2005 is still being used widely and poses threats and vulnerabilities to power grids and the petroleum industry. Malicious hackers, according to the tech giant, are gaining access into secure networks and devices through common Internet of ...

Dynamic Content for Elementor < 1.9.6 - Authenticated RCE

Dynamic Content for Elementor < 1.9.6 - Authenticated RCE

Airlangga   10 February 2023   15.176 Views
The PHP Raw Widget dynamic.ooo widget php raw of the Dynamic Content for Elementor plugin before 1.9.6 did not properly check for user permissions, allowing accounts with a role as low as editor to perform RCE attacks. Proof of Concept POST wp admin admin ajax.php HTTP 1.1 Host exam...

Stored XSS on Chess24.com

Stored XSS on Chess24.com

Ganesha   26 November 2022   20.375 Views
I signed up on Chess24 and a play couple of games. Then I was thinking about security on the Chess24 website. I enter the user profile page, then I put the payload below as my website address. Request Response a href targe...

How to Make a Good Bug Bounty Report

How to Make a Good Bug Bounty Report

Ganesha   30 November 2022   20.099 Views
Report Title Include the type of vulnerability XSS, CSRF, XXE, SQLi, SSRF, etc . Include sub domain and or with directory path example.com Example of a good title Stored XSS at example.com Via Parameter Name Example of a bad title Stored XSS example.com Report fo...

Stored DOM-based XSS on VPSServer.com

Stored DOM-based XSS on VPSServer.com

Airlangga   10 December 2022   25.638 Views
VPSServer.com is a company that sells Virtual Private Servers VPS . A virtual private server VPS is a virtual machine sold as a service by an Internet hosting service. The virtual dedicated server VDS also has a similar meaning. Now let me share how I found a Stored DOM based XSS Vulnerab...

Reflected XSS on UC Browser Website

Reflected XSS on UC Browser Website

Ganesha   05 December 2022   28.498 Views
When I m looking at Alibaba Bug Bounty Programs on HackerOne I am interest in the ucweb.com domain and starting recon. .. images post fb2400f5bb55 alibaba 20domain 20scope.jpg Until I found this URL structure ...

Paraminer: Finds hidden parameters.

Paraminer: Finds hidden parameters.

Ganesha   29 November 2022   25.479 Views
Paraminer is a tool used to search for hidden parameters in a website Main Features GET Request POST Request Usage php paraminer.php u URL w WORDLIST .. images post 6941dbb5d020 64484851 74288d80 d242 11e9 89e5 cf937dd61541.png Link ...

Reflected XSS on sgsg.samsung.com

Reflected XSS on sgsg.samsung.com

Ganesha   27 November 2022   21.989 Views
Like I did before, I use Google Dorks, to find some interesting URLs. Google Dork site sgsg.samsung.com I found a very interesting URL, The HTTP response shows every value from the campu...

Reflected XSS on Xiaomi with KNOXSS

Reflected XSS on Xiaomi with KNOXSS

Ganesha   28 November 2022   20.691 Views
Xiaomi Bug Bounty Programs When we look at Xiaomi Bug Bounty Program, they accept every subdomains from mi.com and xiaomi.com .. images post d6b1f2098768 xiaomi 20writeup1.jpg And I start looking for a subdomain of mi.com with sublist3r .. images...

Reflected XSS on DomaiNesia

Reflected XSS on DomaiNesia

Ganesha   27 November 2022   20.820 Views
DomaiNesia is a company that serves domain name registration, Web Hosting, VPS, and others. I just found Reflected XSS Vulnerability at DomaiNesia s subdomain We required to upload an official document if buy a special domain, like ac. or. sch. etc. On the...

1337.or.id Vulnerability Disclosure Program

1337.or.id Vulnerability Disclosure Program

Ganesha   30 November 2022   20.849 Views
No technology is perfect, and 1337.or.id believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you ve found a security issue in our product or service, we encourage you to notify us. We welcome working with you...

1 2 3