Author Archives: NahamSec

Chaining Multiple Vulnerabilities to Gain Admin Access

In April of this year I participated in a private program on HackerOne that was vulnerable to a series of IDOR that led to a complete takeover of an application. Unfortunately because this is a private program, I cannot disclose the name or company related information per their request. However I wanted to share the details on how I escalated my basic privileges from a regular “customer” account to an admin user. Continue reading

Secure your Jenkins instance or hackers will force you to! (Snapchat’s $5,000 Vulnerability)

After presenting “Doing Recon Like a Boss” at levelUp and releasing a blog post on HackerOne about the same topic, I decided to start looking for a few vulnerabilities on public programs to see if that methodology is still applicable to public programs. As a part of this I decided to look at Slack and Snapchat’s bug bounty programs and preforming my recon exactly as described in the talk.

Continue reading

Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition)

On 5/5/2016 ImageMagick was assigned CVE-2016-3714 “ImageMagick Delegate Arbitrary Command Execution”. Now let’s dig to this vulnerability and how to exploit this.  Having ImageMagick locally installed is advised in order to validate the POC (but not required). For this particular report, I created a file named  exploit.png with the following in the “source code” to get the target’s `id`:

 Continue reading 

Yahoo Image Processing SSRF/XSPA

In this blog post I will be showing a few recent vulnerabilities reported and patched by the Yahoo Security Team. In July of 2014 I was able to identify a SSRF vulnerability affecting all of Yahoo’s services that required an image processing (such as flickr and Yahoo groups). This vulnerability was patched a few weeks ago (June 2015). Now let’s get to the good stuff:

Continue reading

Bug Bounty 101

Recently I was given the opportunity to speak at NBTCon (No Big Thing Con) held at the Sales Force office in San Francisco. In my talk I explained the basics of bug bounties, some ways to maximize your revenue, and also talked about how to make a productive report. Here’s a summary of the talk (with a little bit of extra info/details) and links to the slides: Continue reading

Single vulnerability to cause stored XSS in Yahoo, Flickr, Google, Twitter, Amazon, Youtube, Pinterest and more

Hello, In my last research with Y! Toolbar and Flickr I was able to identify and report a few vulnerabilities to Yahoo. Keep in mind that before starting this research as I was installing a few things on my new box, I had accidentally installed Y! Toolbar on chrome (so my Windows box has chrome, but not my linux box). While poking around Flickr to find a few vulnerabilities, I had set a few titles as different XSS payloads which in the past had never worked but suddenly something was triggering the XSS payloads (keep in mind that I wasn’t able to reproduce my own vulnerabilities on my linux box). So what was causing these to suddenly work ONLY for me? Continue reading

How I XSS’ed All Of Yahoo’s Services

Hello. Normally I don’t write a write-up for XSS vulnerability; however this XSS was a bit different because it affects 100s of Yahoo! subdomains. After my SQL Injection on the HK sub-domains, I decided to actually start focusing on the more major sub-domains of Yahoo, and as a result I was able to XSS quite a few of Yahoo’s services.
Continue reading