Web Hacking 101 How To Make Money Hacking Ethically.pdf

(6007 KB) Pobierz
Web Hacking 101
How to Make Money Hacking Ethically
Peter Yaworski
This book is for sale at
http://leanpub.com/web-hacking-101
This version was published on 2016-06-07
This is a
Leanpub
book. Leanpub empowers authors and publishers with the Lean
Publishing process.
Lean Publishing
is the act of publishing an in-progress ebook using
lightweight tools and many iterations to get reader feedback, pivot until you have the
right book and build traction once you do.
© 2015 - 2016 Peter Yaworski
Tweet This Book!
Please help Peter Yaworski by spreading the word about this book on
Twitter!
The suggested tweet for this book is:
Can’t wait to read Web Hacking 101: How to Make Money Hacking Ethically by
@yaworsk #bugbounty
The suggested hashtag for this book is
#bugbounty.
Find out what other people are saying about the book by clicking on this link to search
for this hashtag on Twitter:
https://twitter.com/search?q=#bugbounty
For Andrea and Ellie. Thanks for supporting my constant roller coaster of motivation
and confidence.
This book wouldn’t be what it is if it were not for the HackerOne Team, thank you for all
the support, feedback and work that you contributed to make this book more than just
an analysis of 30 disclosures.
Contents
1. Foreword
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2. Introduction
. . . . . . . . . . . . .
How It All Started . . . . . . . . .
Just 30 Examples and My First Sale
Who This Book Is Written For . . .
Chapter Overview . . . . . . . . .
Word of Warning and a Favour . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
1
3
3
4
6
7
9
10
13
13
13
13
15
16
18
19
19
20
20
21
22
24
26
26
26
28
29
30
30
3. Background
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4. HTML Injection
. . . . . . . . . . . . . . . . .
Description . . . . . . . . . . . . . . . . . . . .
Examples . . . . . . . . . . . . . . . . . . . . .
1. Coinbase Comments . . . . . . . . . . .
2. HackerOne Unintended HTML Inclusion
3. Within Security Content Spoofing . . . .
Summary . . . . . . . . . . . . . . . . . . . . .
5. HTTP Parameter Pollution
. . . . . . .
Description . . . . . . . . . . . . . . . . .
Examples . . . . . . . . . . . . . . . . . .
1. HackerOne Social Sharing Buttons
2. Twitter Unsubscribe Notifications .
3. Twitter Web Intents . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . .
6. CRLF Injection
. . . . . . . . . . . . .
Description . . . . . . . . . . . . . . . .
1. Twitter HTTP Response Splitting .
2. v.shopify.com Response Splitting
Summary . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
7. Cross-Site Request Forgery
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin