Web Vulnerabilities
Possible opportunities:
- Technology Stack
- Use the follwoing for Angular to test potential vulnerabilities: {{4*4}}[[5*5]]
- Verification emails and URLs of links they contain.
- Multiple users per account? Complex persmission model? Inter-user messaging?
- OAuth and 3rd party services in general.
- Entering HTML or other rich content. Profile pictures!
Tools (to look into):
- IPV4info.com
- Wappalyzer
- EyeWitness
- ZAP Proxy
- Useful command to search for specific files: site:https://play.esea.net/ ext:php
- KnockPy with https://github.com/danielmiessler/SecLists
- Jason Haddix - enumall
- Burp
Thanks
This chapter would not be here if it was not for Web Hacking 101 by Peter Yaworski. Consequently, it could not have been written without HackeOne. Cheers a tonne, guys!