Easy bounties and Hall of fame

1 year ago 71

BOOK THIS SPACE FOR AD

ARTICLE AD

Hi Team, script kiddie is back! After a long Break Here I am talking about a bug which helps you getting bounties and Hall of fame Easily, So let’s start
Here is the bug name is Hyperlink injection in the email invitation.

Hyperlink injection Injection occurs when a hacker has created/injected new pages on an existing website. These pages often contain code that redirects users to other sites or involves the business in attacks against other sites.

I love server what about you :-)

So some website has a facility to invite a user for a group/Team . when Admin invites a user he has to need fill his name last name and email .like in this Then victim Recived a email invition which contains hyperlink

image copied from internet

Note :- [You can also try it like put hyperlink in your username also in your Team Name You can also try ssti , html injection instaed of hyperlink in these fields ]

A hacker can add a malicious file in the form of hyperlink if the user can click on a link a malicious file can be downloaded in his system .

This permits users to send malicious/phishing links to potential clients. It could also have an effect on how spam filters treat your company’s emails.

Hacker can easily invite a member on his malicious url

open redirect to malicious webpage

Hyperlink Injection on Email Invitation

DESCRIPTION
an hyperlink injection in the name when the attacker invites the victim to his organization with injection hyperlink.
reference link :- https://hackerone.com/reports/158554

STEPS
Add first name with the name evil.com and switch it.
Go to xxxx.com and invite
friends user and invite the victim using email.
victim will see the invitation with malicious link

impact:-
a hacker can add a malicious file in the form of hyperlink if the user can click on a link a malicious file can be downloaded in his system .
This permits users to send malicious/phishing links to potential clients. It could also have an effect on how spam filters treat your company's emails.
Hacker can easily invite a member on his malicious url
open redirect to malicious webpage