Auditing an organization's website
Uncategorized
13
Posts
4
Posters
2
Views
-
Auditing an organization's website
Notice that some email links automatically log in as the recipient
Observe
GET https://[redacted domain].com/directlogin.php?userid=[redacted base64]in the redirect chaindecode [redacted base64]
it's my email address and nothing else
replace it with someone else's email
immediately logged in as that person
-
Auditing an organization's website
Notice that some email links automatically log in as the recipient
Observe
GET https://[redacted domain].com/directlogin.php?userid=[redacted base64]in the redirect chaindecode [redacted base64]
it's my email address and nothing else
replace it with someone else's email
immediately logged in as that person
maybe I should switch careers, seems like computer security still has a lot of low-hanging fruit
-
Auditing an organization's website
Notice that some email links automatically log in as the recipient
Observe
GET https://[redacted domain].com/directlogin.php?userid=[redacted base64]in the redirect chaindecode [redacted base64]
it's my email address and nothing else
replace it with someone else's email
immediately logged in as that person
@hazelnoot@enby.life years ago I sucessfully argued for the removal of such links from $work's email messages… it's irritatingly common ☹
(ours at least had some per-account "secret" bit, even if it ended up being a password-equivalent that we happily emailed in cleartext) -
Auditing an organization's website
Notice that some email links automatically log in as the recipient
Observe
GET https://[redacted domain].com/directlogin.php?userid=[redacted base64]in the redirect chaindecode [redacted base64]
it's my email address and nothing else
replace it with someone else's email
immediately logged in as that person
and I just found a different vuln that allows enumerating all email addresses registered to the system
-
and I just found a different vuln that allows enumerating all email addresses registered to the system
holy shit it embeds user passwords plaintext in a hidden field
-
holy shit it embeds user passwords plaintext in a hidden field
@hazelnoot vibe coded af imo
-
holy shit it embeds user passwords plaintext in a hidden field
Wonder if I can access the payment administration section without auth, too...
-
Wonder if I can access the payment administration section without auth, too...
I swear to god, if I get in there and see plaintext card info...
-
Wonder if I can access the payment administration section without auth, too...
oh, yeah I should mention - this thing processes payments and accepts insurance data
-
oh, yeah I should mention - this thing processes payments and accepts insurance data
literally years of PCI (credit card privacy regulations) training, just for this...
-
holy shit it embeds user passwords plaintext in a hidden field
ok I can leak:
- email (username-equivalent)
- password
- email+password for all accounts "managed" by this one
- first/last name
- phone number
- full address
- full date-of-birth
- voting records
- group membership(s)
- group ownership(s)
- system preferences
- org-specified registration ID
- org-specific profile info -
I swear to god, if I get in there and see plaintext card info...
good news: card payments are handled through PayPal, so nothing is leaked there
-
good news: card payments are handled through PayPal, so nothing is leaked there
@hazelnoot At least….
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@ChateauErin alas mine is severe nerve damage
-
@aeva coincidentally a reddit post today directed me to https://en.wikipedia.org/wiki/Tinnitus#Objective_tinnitus which I did not know was a thing
-
An ocean scientist I know lost her federal government job this week. Canada should be scooping up American scientists left and right, not firing our scientists!! She works on carbon observation in the ocean, which is, you know, really fucking important. Everyone else who works on it on the west coast also got cut
Maybe a good time to reach out to your MPs and ask how the fuck we're supposed to be a world leader or whatever if federal scientists are fired and univerities are all drowning?
-
@lqdev@lqdev.me hey, welcome to the Fediverse!
Couple smol things...
When I try to resolve your post by URL, I get a Person back, whoops! Not sure why on NodeBB, I see raw markdown. Was going to inspect source.content, but see #1 :sweat:
-
People who need to bully you are the easiest to push around.
Douglas Adams, The Long Dark Tea-Time of the Soul (Dirk Gently, #2)
-
-
@boris @dmian @scottjenson this is something that was designed into ActivityPub and has largely been ignored. We're doing a lot of work on it at the W3C SocialCG group.
