Search for a command to run...
I am a DevOps Engineer & Security Researcher. I'm currently working as a Senior DevOps Engineer at BuckHill Software, building infrastructure to support large scale cloud based Insurance software. You can shoot me a message :) consult@webspearsecurity.com.
No comments yet. Be the first to comment.
While exploring a renowned local company's website, I encountered a link that redirected me to a suspicious-looking web application. Upon inspecting the application, it became evident that it was certainly susceptible to a security issue; however, th...
In our interconnected world, where technology plays a pivotal role in every aspect of our lives, the importance of cyber security cannot be overstated. As technology advances, so do the risks associated with it. One critical aspect of bolstering cybe...
As the year 2023 draws to a close, it's time to take a retrospective journey through the rollercoaster of experiences, challenges, and achievements that defined this year for me. From career highs to unexpected lows, this year was a testament to adap...
I received an invitation to a HackerOne private program. This came after being away from the bug bounty scene for close to 5 months straight. So I decided to take a look in hopes of finding something.
The program had a small scope. It's main production and staging applications were the only ones in scope, dashboard.redacted.co and staging-dashboard.redacted.co. I created an account in the production app and started checking out the functionalities of the application.
It was day two of testing the application and still could not find anything significant worth reporting. So I decided to switch tactics and do a little bit of recon. Given that only two domains were in scope, I did'nt have much options for recon other than JavaScript analysis and GitHub recon.
The program had a GitHub org for sharing their public plugins with the developer community. I navigated all the public repositories looking at the commit history for any information that could be of interest.
After a few hours, one repo piqued my interest, due to references to apiKey parameters. I digged into the source code and managed to find working apiKeys for the staging environment.
Among other attack vectors, the program was also mostly interested in the ability of an attacker to gain access to other users' video recordings. They offered services similar to Google Meets, with the ability of recording meeting sessions which were stored in S3 buckets.
Using a valid apiKey, you could retrieve AWS S3 presigned URLS to download recordings in the S3 buckets via the API if the apiKey had the permissions to. I was lucky in that the apiKey leaked in the GithHub repo had admin permissions across the org, allowing me to retrieve download URLS for every recording in the org.
I was able to access meeting recordings of employees of the company, testing new features of the product and having private discussions. I filed a report on HackerOne and they triaged it as a High severity issue, paying a 4 digit bounty and an additional $50 for completing a retest.
It's common to face a target with a narrow scope. In such cases always try to widen the attack surface within limits that could still fall into scope as dictated by the bug bounty program policy.