Nikhil Mittal's Blog

Hi folks, This post is about one of my recent finding in a private bug bounty program. Since the program refused for public  disclosure  (i don't know why) i am not attaching any screenshots. But still i will try to explain the idea. Let's call the site as example.com, So example.com is a trading platform and they have a limited trial period after that you have to spend $$ to renew your account. And the most irritating part is once your trial account is expire example.com lands you to https://example.com/subscription/expired  every time.  So i created a new trial account and start checking common endpoints like profile page, account balance page, recent activities page etc. After i tried to get those endpoints with my old expired account and every time i was landing to  https://example.com/ subscription/expired :( Now the challenges was to somehow get and update information of my old expired account. Luckily they have a API which is used to fetch, update and t

Hi folks, This post is about of one of my recent my finding in a bug bounty program. I started checking the application for common vulnerabilities but got nothing after spending an hour I came across an endpoint which looks as follows. If you look at request and response you will see the value of status parameter is reflecting back in the response. So I tried replacing the value of status parameter and same reflected back in the response as shown in below. What next? Let’s check for XSS with a simple payload as shown in below. But angle brackets getting filtered, after I tried some encodings but nothing worked. So I was about to give up but suddenly i decided to try array tricks. So you can see whatever we write inside the round brackets is reflecting back in response as it becomes associated array as follows Status    Equals JSON object <haha> Equals Key of JSON object T