https://ctulhu.me/tags/bugbounty/ Recent content in bugbounty on Christian Niel Angel Hugo -- gohugo.io en © 2024 Christian Niel Angel Sun, 14 May 2023 00:00:00 +0000 https://ctulhu.me/security/full-passcode-bypass-on-nextcloud-app-ios/ Sun, 14 May 2023 00:00:00 +0000 https://ctulhu.me/security/full-passcode-bypass-on-nextcloud-app-ios/ It’s possible to fully access the user’s nextcloud files on Nextcloud App iOS by using the Files app on iPhone. Proof of Concept: # Download the nextcloud iOS app Login your account set a passcode Open the files app then go to > Browse Under the locations pick nextcloud click turn on References # https://hackerone. https://ctulhu.me/security/ability-to-read-any-emails-through-idor-on-nextcloud-mail/ Fri, 12 May 2023 00:00:00 +0000 https://ctulhu.me/security/ability-to-read-any-emails-through-idor-on-nextcloud-mail/ An attacker can access the mail box by ID getting the subjects and the first characters of the emails. References # https://hackerone.com/reports/1784681 https://nvd.nist.gov/vuln/detail/CVE-2023-25160 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx https://ctulhu.me/security/messages-can-still-be-seen-on-conversation-after-expiring-when-cron-is-misconfigured/ Mon, 01 May 2023 00:00:00 +0000 https://ctulhu.me/security/messages-can-still-be-seen-on-conversation-after-expiring-when-cron-is-misconfigured/ Nextcloud talk has a feature called Message Expiration, Chat messages can be expired after a certain time. In order for messages to be removed from the database, the cron jobs need to be executed. https://ctulhu.me/security/ability-to-control-the-filename-when-uploading-a-logo-or-favicon-on-theming/ Mon, 10 Apr 2023 00:00:00 +0000 https://ctulhu.me/security/ability-to-control-the-filename-when-uploading-a-logo-or-favicon-on-theming/ When uploading a logo or favicon the filename can be controlled by attacker since the key can be modified which serves as the filename. Proof of Concept: # go to http://localhost/settings/admin/theming upload a logo or favicon intercept the request using burp modify the key References # https://hackerone. https://ctulhu.me/security/passcode-bypass-on-talk-android-app/ Thu, 05 Jan 2023 00:00:00 +0000 https://ctulhu.me/security/passcode-bypass-on-talk-android-app/ It is possible to bypass the passcode protection in nextcloud android talk by clicking the notification of a message. Proof of Concept: # Create two users Using User A login it to the web interface while User B on Talk App Android Using User B setup the passcode protection in settings Using User A send a message to User B Wait for the notification and click it References # https://hackerone. https://ctulhu.me/security/file-and-chat-disclosure-by-calling-the-device-while-its-in-locked-state/ Wed, 09 Mar 2022 00:00:00 +0000 https://ctulhu.me/security/file-and-chat-disclosure-by-calling-the-device-while-its-in-locked-state/ Talk app allows access to sensitive chat messages on lockscreen during a call Summary # An attacker with physical access can gain access to the chat messages and files of the user by calling the victim phone while its in locked state. https://ctulhu.me/security/nextcloud-talk-objectid-in-share-location-can-be-set-to-open-arbitrary-url-or-deeplinks/ Tue, 08 Mar 2022 00:00:00 +0000 https://ctulhu.me/security/nextcloud-talk-objectid-in-share-location-can-be-set-to-open-arbitrary-url-or-deeplinks/ It is possible to control the geolocation preview in the Nextcloud Talk app to point to a domain or deeplink which results to open-redirect. Summary # The nextcloud Talk app allows a User to share their location via app. https://ctulhu.me/security/sophos-secure-workspace-app-password-bypass-using-race-condition/ Sat, 30 Oct 2021 00:00:00 +0000 https://ctulhu.me/security/sophos-secure-workspace-app-password-bypass-using-race-condition/ A race condition in Sophos Secure Workspace (Android) version 9.7.3081 that bypassed the App Password. An Activity is an application component that provides a UI for users to interact with. https://ctulhu.me/security/breaking-the-doors-paypal-2-factor-bypass/ Wed, 02 Dec 2020 00:00:00 +0000 https://ctulhu.me/security/breaking-the-doors-paypal-2-factor-bypass/ Two-Factor Authentication bypass on Paypal Hi! It’s been a while since my last write up. I hope you’ll like this one. Take care and be safe! Two-factor authentication is an extra layer of security for your Paypal Account designed to ensure that you’re the only person who can access your account, even if someone knows your password. https://ctulhu.me/security/non-verified-user-can-submit-reportview-disclosed-reports-secuna-bug-bounty/ Thu, 13 Feb 2020 00:00:00 +0000 https://ctulhu.me/security/non-verified-user-can-submit-reportview-disclosed-reports-secuna-bug-bounty/ I was able to find a bug that lets me submit report,edit profile and view disclosed reports in secuna while using a rejected or non-verified account. Details # Currently i have 2 accounts at secuna. https://ctulhu.me/security/insufficient-rate-limitting-on-facebook-fundraisers/ Tue, 13 Aug 2019 00:00:00 +0000 https://ctulhu.me/security/insufficient-rate-limitting-on-facebook-fundraisers/ Facebook Fundraisers Lacks Rate Limiting Protection. Malicious actors can bruteforce this by sending different random credit or debit card numbers. Summary Facebook Fundraisers Lacks Rate Limiting Protection. Malicious actors can bruteforce this by sending different random credit or debit card numbers.