Security Notes
  • Whoami
  • Pentesting
    • WEP-Pen
      • Reconnaissance
      • Enumeration
      • OWSAP TOP 10
        • Injection
          • Cross Site Scripting
            • Cross Site Scripting
            • Exploitation
            • Protections
          • SQL Injection
            • SQL Injection Overview
          • NoSQL Injection
          • CRLF Injection
          • XML Injection
        • Broken Access Control
          • Path Traversal
          • Sensitive Cookie with Improper SameSite Attribute
          • Link Following
          • Incorrect Default Permissions
          • Information disclosure
          • CSRF
            • csrf checklist
          • 403 bypass
          • Exposure of WSDL File Containing Sensitive Information
          • bussiness logic checklist
          • 2FA bypass checklist
          • admin panal checklist
          • idor checklist
          • Authentication checklist
          • reset_password_checklist
          • ATO
        • Cryptographic Failures
          • Cryptographic Failure
          • Weak Encoding for Password
          • Improper Following of a Certificate's Chain of Trust
            • Understanding Digital Certificates : Self-Signed and CA-Signed Certificate **
            • Transport Layer Security (TLS) and SSL **
          • Clear Text Transmission Of Sensitive Data
            • SSLStripping **
        • Insecure Design
        • Security Misconfiguration
          • CORS Miscofigration
          • Mail Server Misconfiguration
        • Vulnerable and Outdated Components
          • Using Components with Known Vulnerabilities
        • Identification and Authentication Failures
          • JWT Hacking
          • SAML Authentication bypass
        • Software and Data Integrity Failures
          • mass assignment
          • PostMessage Vulnerabilities
            • PostMessage Vulnerabilities
            • Blocking main page to steal postmessage
            • Bypassing SOP with Iframes - part 1
            • Bypassing SOP with Iframes - part 2
            • Steal postmessage modifying iframe location
        • Security Logging and Monitoring Failures
        • Server-Side Request Forgery (SSRF)
          • SSRF
      • Checklists
        • aem misconfiguration
        • exif_geo
        • xss
        • Session Management
        • Authorization
        • cookie
        • Django
        • Symfony
        • json
        • bypass rate limit
        • Rce
        • Register Page
      • eWPTXv2 Preparation
        • Encoding & Filtering
        • Evasion Basics
        • Cross-site scripting (XSS)
        • XSS Filter Evasion
        • Cross-site request forgery (CSRF
        • HTML5
      • API-Pen
        • API Discovry
        • Reverse Engineering API Documentation
        • Excessive Data Exposure
        • Vulnerability Scanning
        • API Authentication Attacks
          • Classic Authentication Attacks
          • API Token Attacks
        • API Authorization Attacks
          • Broken Object Level Authorization (BOLA)
          • Broken Function Level Authorization
        • Improper Assets Management
        • Mass Assignment
        • SSRF
        • Injection Attacks in API
        • Evasive Maneuvers
        • GraphQL Vulnerabilities
    • NET-Pen
      • Active Directory Pentesting
        • Active Directory Components
        • Initial Attack Vectors
          • LLMNR Poisoning
          • SMB Relay Attacks
          • IPv6 Attacks ( IPv6 DNS Takeover )
          • Printer Hacking
          • Methodology
          • Some Other Attacks
            • Zerologon (CVE-2020-1472)
            • PrintNightmare (CVE-2021-1675)
        • Post-Compromise Attacks
          • Pass Attacks
          • Kerberoasting Attack
          • Token Impersonation Attack
          • LNK File Attack
          • GPP / cPassword Attacks
          • Mimikatz
          • Methodology
        • We've Compromised the Domain
          • Dumping the NTDS.dit
          • Golden Ticket Attacks
          • Methodology
        • Case Study
        • Password Attacks
      • Attack Vectors by Port
        • FTP 21
        • SSH 22
        • Telnet 23 - 2323
        • SMTP 25
        • DNS 53
        • Kerberos 88
        • POP 110-995
        • RPC 111
        • Ident 113
        • NNTP 119
        • NetBIOS 137-138
        • SMB / Samba 135-139, 445
        • MSRPC 135
        • SNMP 161
        • LDAP 389,636
        • Modbus 502
        • OpenSSL 1337
        • Ms-SQL 1433
        • Oracle Listener 1521 1522 1529
        • NFS 2049
        • MySql 3306
        • RDP 3389
        • ADB Android Debug Bridge 5555
        • WinRM 5985 5986
        • VNC 5800 5900
        • Redis 6379
        • Unreal IRC 6667
        • Tomcat 8080
        • MongoDB 27017
        • http 80
      • Network basics
      • Information Gathering
      • Privilege Escalation
        • Windows Privilege Escalation
        • Linux Privilege Escalation
    • write-ups
      • How i found a Privilege Escalation via Impersonation Features feature
      • How I was able to discover ATO Via IDOR vulnerability
      • Easy full Account Takeover via Facebook OAuth Misconfiguration
Powered by GitBook
On this page
  1. Pentesting
  2. WEP-Pen
  3. Checklists

Authorization

Predictable ID

GET /api/v1/account/**2222** 
Token: UserA_token

GET /api/v1/account/**3333** 
Token: UserA_token

ID combo

GET /api/v1/**UserA**/data/2222 
Token: UserA_token

GET /api/v1/**UserB**/data/3333 
Token: UserA_token

Integer as ID

POST /api/v1/account/ 
Token: UserA_token 
{"Account": 2222 }


POST /api/v1/account/ 
Token: UserA_token 
{"Account": [3333]}

Email as user ID

POST /api/v1/user/account 
Token: UserA_token 
{"email": " UserA@email.com"}


POST /api/v1/user/account 
Token: UserA_token 
{"email": " UserB@email.com"}

Group ID

GET /api/v1/group/CompanyA 
Token: UserA_token

GET /api/v1/group/CompanyB
Token: UserA_token

Group and user combo

POST /api/v1/group/CompanyA 
Token: UserA_token 
{"email": " userA@CompanyA .com"}

POST /api/v1/group/CompanyB 
Token: UserA_token 
{"email": " userB@CompanyB .com"}

Nested object

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": {"Account" :3333}}

Multiple objects

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222, "Account": 3333, "Account": 5555 }

Predictable token

POST /api/v1/user/account 
Token: UserA_token 
{"data": "DflK1df7jSdfa1acaa"}

POST /api/v1/user/account
Token: UserA_token 
{"data": "DflK1df7jSdfa2dfaa"}

10-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222%0d%0a1111 }

11-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222%0a1111 }

12-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222%0d1111 }

13-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222%001111 }

14-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": [2222,1111] }

15-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222;1111 }

16-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222,1111 }

17-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222|1111 }

18-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222%0a%0dcc:1111 }

19-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222&1111 }

20-method

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222 }

POST /api/v1/user/checking 
Token: UserA_token 
{"Account": 2222#%1111 }
PreviousSession ManagementNextcookie