Gospel
@4osp3l • 20,317 subscribers
Hacker . Security Researcher
Shorts
Videos
![I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.](https://image.24vids.com/tw-1986132356822929604/amplify_video_thumb/1986132057987186689/img/guLXAOUvmNJiFf4X.jpg)
I said I'm going to publish a technical article on how to test newsletter subscription functionality for BAC/XSS, I'll just drop it here instead; before we jump into testing these "newsletter subscription" features, we need to find them; here's a dork I use to find them [ site: ("subscribe"|"newsletter"|"unsubscribe") ]... most hackers don't look into these features, so this is a good opportunity; you can find vulnerabilities like XSS, IDOR/BAC, and even SQLi. In some cases the form only asks for your email, no name, country, etc. That doesn't stop you from testing XSS, but it can make IDOR testing harder to spot... if the email you enter is reflected back on the page, that's a great vector to test for XSS.
Gospel12,744 просмотров • 8 месяцев назад
Open Redirect ❌ Open Redirect + RXSS ✅ Open Redirect + RXSS + ATO ✅✅ Always escalate if possible.
Gospel11,773 просмотров • 1 год назад
Больше нет контента для загрузки