(Ebook) Real-World Bug Hunting: A Field Guide To Web Hacking by Peter Yaworski ISBN 9781593278618, 1593278616 PDF Download
(Ebook) Real-World Bug Hunting: A Field Guide To Web Hacking by Peter Yaworski ISBN 9781593278618, 1593278616 PDF Download
https://ebooknice.com/product/real-world-bug-hunting-a-field-
guide-to-web-hacking-11176530
(Ebook) Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities
EARLY ACCESS EDITION by Vickie Li ISBN 9781718501546, 9781718501553, 1718501544,
1718501552
https://ebooknice.com/product/bug-bounty-bootcamp-the-guide-to-finding-and-
reporting-web-vulnerabilities-early-access-edition-32544858
ebooknice.com
(Ebook) Test iOS apps with UI Automation: bug hunting made easy by Jonathan Penn
ISBN 9781937785529, 1937785521
https://ebooknice.com/product/test-ios-apps-with-ui-automation-bug-hunting-made-
easy-11925456
ebooknice.com
(Ebook) Forex Revolution: An Insider's Guide to the Real World of Foreign Exchange
Trading by Peter Rosenstreich ISBN 9780131486904, 013148690X
https://ebooknice.com/product/forex-revolution-an-insider-s-guide-to-the-real-
world-of-foreign-exchange-trading-1309396
ebooknice.com
https://ebooknice.com/product/serviceoriented-architecture-a-field-guide-to-
integrating-xml-and-web-services-1275690
ebooknice.com
(Ebook) Ethical Hacking: A Comprehensive Beginner's Guide to Learn and Understand
the Concept of Ethical Hacking 2023 by Joe Grant
https://ebooknice.com/product/ethical-hacking-a-comprehensive-beginner-s-guide-
to-learn-and-understand-the-concept-of-ethical-hacking-2023-50945896
ebooknice.com
(Ebook) VMware Cookbook: A Real-World Guide to Effective VMware Use by Ryan Troy
ISBN 9780596801748, 0596801742
https://ebooknice.com/product/vmware-cookbook-a-real-world-guide-to-effective-
vmware-use-1272562
ebooknice.com
(Ebook) Web Security Field Guide by Steve Kalman ISBN 9781587050923, 1587050927
https://ebooknice.com/product/web-security-field-guide-978040
ebooknice.com
(Ebook) Shooter's Bible Guide to Whitetail Strategies: Deer Hunting Skills, Tactics,
and Techniques by Peter J. Fiduccia ISBN 9781616083588, 1616083581, B084VVKV8K
https://ebooknice.com/product/shooter-s-bible-guide-to-whitetail-strategies-
deer-hunting-skills-tactics-and-techniques-10714130
ebooknice.com
(Ebook) Real-World Python: A Hacker's Guide to Solving Problems with Code by Lee
Vaughan ISBN 9781718500624, 1718500629
https://ebooknice.com/product/real-world-python-a-hacker-s-guide-to-solving-
problems-with-code-12059626
ebooknice.com
Contents in Detail
1. Cover Page
2. Title Page
3. Copyright Page
4. About the Author
5. About the Technical Reviewer
6. Brief Contents
7. Contents in Detail
8. Foreword by Michiel Prins and Jobert Abma
9. Acknowledgments
10. Introduction
1. Server-Side HPP
2. Client-Side HPP
3. HackerOne Social Sharing Buttons
4. Twitter Unsubscribe Notifications
5. Twitter Web Intents
6. Summary
1. Authentication
2. CSRF with GET Requests
3. CSRF with POST Requests
4. Defenses Against CSRF Attacks
5. Shopify Twitter Disconnect
6. Change Users Instacart Zones
7. Badoo Full Account Takeover
8. Summary
1. SQL Databases
2. Countermeasures Against SQLi
3. Yahoo! Sports Blind SQLi
4. Uber Blind SQLi
5. Drupal SQLi
6. Summary
1. Buffer Overflows
2. Read Out of Bounds
3. PHP ftp_genlist() Integer Overflow
4. Python Hotshot Module
5. Libcurl Read Out of Bounds
6. Summary
1. Reconnaissance
2. Testing the Application
3. Going Further
4. Summary
31. A Tools
1. Web Proxies
2. Subdomain Enumeration
3. Discovery
4. Screenshotting
5. Port Scanning
6. Reconnaissance
7. Hacking Tools
8. Mobile
9. Browser Plug-Ins
32. B Resources
1. Online Training
2. Bug Bounty Platforms
3. Recommended Reading
4. Video Resources
5. Recommended Blogs
33. Index
REAL-WORLD BUG
HUNTING
A Field Guide to Web Hacking
by Peter Yaworski
San Francisco
REAL-WORLD BUG HUNTING. Copyright © 2019 by Peter Yaworski.
All rights reserved. No part of this work may be reproduced or transmitted in any
form or by any means, electronic or mechanical, including photocopying,
recording, or by any information storage or retrieval system, without the prior
written permission of the copyright owner and the publisher.
ISBN-10: 1-59327-861-6
ISBN-13: 978-1-59327-861-8
No Starch Press and the No Starch Press logo are registered trademarks of No
Starch Press, Inc. Other product and company names mentioned herein may be the
trademarks of their respective owners. Rather than use a trademark symbol with
every occurrence of a trademarked name, we are using the names only in an
editorial fashion and to the benefit of the trademark owner, with no intention of
infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty.
While every precaution has been taken in the preparation of this work, neither the
author nor No Starch Press, Inc. shall have any liability to any person or entity with
respect to any loss or damage caused or alleged to be caused directly or indirectly
by the information contained in it.
About the Author
Peter Yaworski is a self-taught hacker thanks to the generous
knowledge sharing of so many hackers who came before him,
including those referenced in this book. He is also a successful
bug bounty hunter with thanks from Salesforce, Twitter,
Airbnb, Verizon Media, and the United States Department of
Defense, among others. He currently works at Shopify as an
Application Security Engineer, helping to make commerce
more secure.
About the Technical Reviewer
Tsang Chi Hong, also known as FileDescriptor, is a pentester
and a bug bounty hunter. He lives in Hong Kong. He writes
about web security at https://blog.innerht.ml, enjoys listening
to original soundtracks, and owns some cryptocurrencies.
BRIEF CONTENTS
Foreword by Michiel Prins and Jobert Abma
Acknowledgments
Introduction
Appendix A: Tools
Appendix B: Resources
Index
CONTENTS IN DETAIL
FOREWORD by Michiel Prins and Jobert Abma
ACKNOWLEDGMENTS
INTRODUCTION
Who Should Read This Book
How to Read This Book
What’s in This Book
A Disclaimer About Hacking
1
BUG BOUNTY BASICS
Vulnerabilities and Bug Bounties
Client and Server
What Happens When You Visit a Website
Step 1: Extracting the Domain Name
Step 2: Resolving an IP Address
Step 3: Establishing a TCP Connection
Step 4: Sending an HTTP Request
Step 5: Server Response
Step 6: Rendering the Response
HTTP Requests
Request Methods
HTTP Is Stateless
Summary
2
OPEN REDIRECT
How Open Redirects Work
Shopify Theme Install Open Redirect
Takeaways
Shopify Login Open Redirect
Takeaways
HackerOne Interstitial Redirect
Takeaways
Summary
3
HTTP PARAMETER POLLUTION
Server-Side HPP
Client-Side HPP
HackerOne Social Sharing Buttons
Takeaways
Twitter Unsubscribe Notifications
Takeaways
Twitter Web Intents
Takeaways
Summary
4
CROSS-SITE REQUEST FORGERY
Authentication
CSRF with GET Requests
CSRF with POST Requests
Defenses Against CSRF Attacks
Shopify Twitter Disconnect
Takeaways
Change Users Instacart Zones
Takeaways
Badoo Full Account Takeover
Takeaways
Summary
5
HTML INJECTION AND CONTENT SPOOFING
Coinbase Comment Injection Through Character Encoding
Takeaways
HackerOne Unintended HTML Inclusion
Takeaways
HackerOne Unintended HTML Include Fix Bypass
Takeaways
Within Security Content Spoofing
Takeaways
Summary
6
CARRIAGE RETURN LINE FEED INJECTION
HTTP Request Smuggling
v.shopify.com Response Splitting
Takeaways
Twitter HTTP Response Splitting
Takeaways
Summary
7
CROSS-SITE SCRIPTING
Types of XSS
Shopify Wholesale
Takeaways
Shopify Currency Formatting
Takeaways
Yahoo! Mail Stored XSS
Takeaways
Google Image Search
Takeaways
Google Tag Manager Stored XSS
Takeaways
United Airlines XSS
Takeaways
Summary
8
TEMPLATE INJECTION
Server-Side Template Injections
Client-Side Template Injections
Uber AngularJS Template Injection
Takeaways
Uber Flask Jinja2 Template Injection
Takeaways
Rails Dynamic Render
Takeaways
Unikrn Smarty Template Injection
Takeaways
Summary
9
SQL INJECTION
SQL Databases
Countermeasures Against SQLi
Yahoo! Sports Blind SQLi
Takeaways
Uber Blind SQLi
Takeaways
Drupal SQLi
Takeaways
Summary
10
SERVER-SIDE REQUEST FORGERY
Demonstrating the Impact of Server-Side Request Forgery
Invoking GET vs. POST Requests
Performing Blind SSRFs
Attacking Users with SSRF Responses
ESEA SSRF and Querying AWS Metadata
Takeaways
Google Internal DNS SSRF
Takeaways
Internal Port Scanning Using Webhooks
Visit https://ebooknice.com to
discover a wide range of
eBooks across various genres.
Enjoy exclusive deals and
discounts to enhance your
reading experience. Start your
digital reading journey today!
Takeaways
Summary
11
XML EXTERNAL ENTITY
eXtensible Markup Language
Document Type Definitions
XML Entities
How XXE Attacks Work
Read Access to Google
Takeaways
Facebook XXE with Microsoft Word
Takeaways
Wikiloc XXE
Takeaways
Summary
12
REMOTE CODE EXECUTION
Executing Shell Commands
Executing Functions
Strategies for Escalating Remote Code Execution
Polyvore ImageMagick
Takeaways
Algolia RCE on facebooksearch.algolia.com
Takeaways
RCE Through SSH
Takeaways
Summary
13
MEMORY VULNERABILITIES
Buffer Overflows
Read Out of Bounds
PHP ftp_genlist() Integer Overflow
Takeaways
Python Hotshot Module
Takeaways
Libcurl Read Out of Bounds
Takeaways
Summary
14
SUBDOMAIN TAKEOVER
Understanding Domain Names
How Subdomain Takeovers Work
Ubiquiti Subdomain Takeover
Takeaways
Scan.me Pointing to Zendesk
Takeaways
Shopify Windsor Subdomain Takeover
Takeaways
Snapchat Fastly Takeover
Takeaways
Legal Robot Takeover
Takeaways
Uber SendGrid Mail Takeover
Takeaways
Summary
15
RACE CONDITIONS
Accepting a HackerOne Invite Multiple Times
Takeaways
Exceeding Keybase Invitation Limits
Takeaways
HackerOne Payments Race Condition
Takeaways
Shopify Partners Race Condition
Takeaways
Summary
16
INSECURE DIRECT OBJECT REFERENCES
Finding Simple IDORs
Finding More Complex IDORs
Binary.com Privilege Escalation
Takeaways
Moneybird App Creation
Takeaways
Twitter Mopub API Token Theft
Takeaways
ACME Customer Information Disclosure
Takeaways
Summary
17
OAUTH VULNERABILITIES
The OAuth Workflow
Stealing Slack OAuth Tokens
Takeaways
Passing Authentication with Default Passwords
Takeaways
Stealing Microsoft Login Tokens
Takeaways
Swiping Facebook Official Access Tokens
Takeaways
Summary
18
APPLICATION LOGIC AND CONFIGURATION
VULNERABILITIES
Bypassing Shopify Administrator Privileges
Takeaways
Bypassing Twitter Account Protections
Takeaways
HackerOne Signal Manipulation
Takeaways
HackerOne Incorrect S3 Bucket Permissions
Takeaways
Bypassing GitLab Two-Factor Authentication
Takeaways
Another Random Scribd Document
with Unrelated Content
the discovery of an anonymous production entitled ‘Lady Anne’
the editor finds his reward for much fruitless rummaging. We
share his gratification, for it is a gem well worth preserving.”
(Ath.)
“The book is worth its room, were it only for the copious lists
of words and phrases—correct and incorrect—common mistakes,
and trite expressions, which it contains.”
+ Cath. World. 85: 682. Ag. ’07. 170w.
+
“Few Irish books of such good parts have come into our hands
since Carleton’s days, for few authors hold the balance so
accurately or write so restrainedly and so simply as Mr. Lysaght,
content to fill their pages with the moving figures of men,
animated by the spirit of life itself.”
+ Acad. 72: 188. F. 23, ’07. 590w.
+
“Compelling story.”
+ A. L. A. Bkl. 3: 136. My. ’07.
“The worst fault, indeed, of the story is a certain want of what
journalists style actuality.”
+ Ath. 1907, 1: 250. Mr. 2. 270w.
−
“Mr. Lysaght often shows a keen perception of character
without the art of sustained development. Many of his people
are quite shadowy. He is likewise guilty of self-indulgence in the
matter of length.”
+ Nation. 84: 267. Mr. 21, ’07. 440w.
−
“Apart from its general fairmindedness, the book is notable for
many passages affording welcome relief to its prevalently serious
character.”
+ Spec. 98: 295. F. 22, ’07. 1540w.
M
“The book takes its title from the caption of the first story, but
it is suitable for the collection as a whole. For most of the stories
recount a contest of some sort, of wit or will, or feeling, or
intention, between people of opposite sex, in which the woman
is usually the victor.”—N. Y. Times.
“Notable in the novel are its gaiety and brightness, and its deft
literary workmanship. We must not seek dull realism here; it is a
field of sheer entertainment.”
+ Ath. 1907, 1: 693. Je. 8. 180w.
“The tale is told with quiet humour, sympathy, and an
underlying vein of poetry that lends a definite charm to many of
the pages.” Frederic Taber Cooper.
+ Bookm. 25: 500. Jl. ’07. 370w.
“Mr. McCarthy presents Villon in the light of a perfectly
monogamous Shelley. Apart from this somewhat trying piece of
originality, the book has merit.”
+ Nation. 84: 567. Je. 20, ’07. 260w.
−
“It is a more thoughtful book than ‘If I were king,’ a harder
book to write, a book with much subtle analysis, and quite
probably McCarthy himself likes it better. It’s a question whether
the public, fain to stay unjarred in their rose-colored dream of
romantic passion, will agree with his possible estimate.”
+ N. Y. Times. 12: 387. Je. 15, ’07. 450w.
−
“After discussing the city engineer and his duties the author
takes up, in turn, roads and streets, sidewalks, curbs and
gutters, pavements, sanitation in general, drainage, sewerage,
water supply, concrete, building departments, miscellaneous data
(in the course of which a few paragraphs on lighting are given),
contracts and specifications, office systems, records, field work
and engineering data. Appendixes are devoted to concrete
mixing machines, trenching machines, bibliography, trade
literature and specification index.”—Engin. N.
“The humour and spirit of the book are well sustained by the
illustrations.”
+ Ath. 1907, 2: 613. N. 16. 170w.
“Since the pursuit of literature, on the part of both authors
and publishers—has transmuted itself from the desire to do
something worth while into the endeavor to hit the bull’s eye of
popular taste, that fact is perhaps justification for Mr.
McCutcheon’s numerous books. Otherwise it is impossible to
understand why they should be either written or published.”
− N. Y. Times. 12: 620. O. 12, ’07. 670w.
“In addition to the various good qualities of the author shown
in the book there is a good bit of character drawing in Crow.”
+ N. Y. Times. 12: 652. O. 19, ’07. 70w.
“Mr. McCutcheon, who told a good story in ‘Jane Cable,’ tells a
better one in ‘The daughter of Anderson Crow.’”
+ Sat. R. 104: 582. N. 9, ’07. 270w.
“The chief merit of the work lies in its graphic pictures of life in
the mining camps, and of the quaint humours of their inmates,
whom the author portrays in the most kindly spirit. As Mr.
Macdonald in his preface lays claim to entire accuracy in
geographical detail, we may mention one or two points on which
his memory seems to be at fault.”
+ Ath. 1905, 2: 759. D. 2. 520w.
−
“At times his adventures are a little too marvelous, the
coincidences a bit too striking, and the luck or ill-luck slightly too
much colored; but we can appreciate the stories for they are
capitally told.” H. E. Coblentz.
+ Dial. 43: 374. D. 1, ’07. 170w.
−
“Their adventures are worth the telling, and Mr. Macdonald has
told them well. These are right good stories.”
+ N. Y. Times. 12: 699. N. 2, ’07. 140w.
“He has experiences to recount which we do not expect to find
outside the boy’s adventure book. He writes admirably and
picturesquely, notwithstanding his reminder that he knows more
of the rifle than the pen.”
+ Sat. R. 100: sup. 10. O. 14, ’05. 320w.
“No book of the kind we have come across for long so
decidedly merits reading.”
+ Spec. 97: sup. 473. O. 6, ’06. 180w.
+
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
ebooknice.com