List of active bug bounty programs

Here’s a list of currently active bug bounty programs

• Bugcrowd – http://bgcd.co/join-the-bugcrowd
• Facebook - http://www.facebook.com/whitehat/bounty/
• Etsy – http://www.etsy.com/help/article/2463
• Google – http://www.google.com/about/company/rewardprogram.html 
• Paypal – https://www.paypal.com/us/webapps/mpp/security/reporting-security-issues
• Mozilla – http://www.mozilla.org/security/bug-bounty.html
• Piwik – http://piwik.org/security/
• Barracuda – http://www.barracudalabs.com/bugbounty/
• Yandex – http://company.yandex.com/security/index.xml
• Gallery - http://codex.gallery2.org/Bounties
• Qmail - http://cr.yp.to/djbdns/guarantee.html
• AT&T - http://developer.att.com/developer/apiDetailPage.jsp?passedItemId=10700235 - (We’ve been told that to submit you need to sign up to the Developer API Program which costs 99 USD…)
• Tarsnap - https://www.tarsnap.com/bugbounty.html
• Samsung - https://samsungtvbounty.com/
• Access - https://www.accessnow.org/prize
• Avast! – http://blog.avast.com/2013/01/25/introducing-avast-bug-bounty/
• Hex-Rays - http://www.hex-rays.com/bugbounty.shtml
• Kaneva - http://docs.kaneva.com/mediawiki/index.php/Bug_Bounty
• Mega.co.nz - http://thenextweb.com/insider/2013/02/01/kim-dotcom-puts-up-13500-bounty-for-first-person-to-break-megas-security-system/
• Cryptocat - https://crypto.cat/bughunt/

Stored XSS On Rediff Mail

Hi Guys, I recently discovered Stored XSS Issue on Rediff mail and also reported this issue to Rediff Recently. :-)

But didn't get any Credit but Still never mind.

They actually dropped me mail on personal id that issue has been fixed now.

I will show exact demonstration of that Stored XSS issue.

But, First of all i will tell you what XSS is basically.

XSS (Cross-Site Scripting)-

Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by your browser and used with that site. 

There are basically two types of XSS:

1) Reflected XSS Attacks

2) Stored XSS Attacks

So, Let  get Start with attack

Now, this is an extremely critical vulnerability as the user will be attacked by simply visiting malicious user profile and the malicious script will execute on the victim browser.

Here is a proof of concept  of Stored XSS on Rediffmail:)
1)Hosted JavaScript File locally

with following content:

"document.write ("Stored XSS " + document.cookie);
alert ("cookie Value" + document.cookie);"

Hosted JavaScript for XSS:Securityvin32

2)Parameter Affected: School and college combined

Here is the tricky part i faced during XSS

here individual school and college parameter didn't get xss alert.

So i tried to combined both field by using following vector:

School:
/><SCRIPT SRC="http://localhost/xss/xss.js"/*

College: 

*/></SCRIPT>

 

3) After saving the attack vector in his profile.

Any user who visit attacker profile will get malicious script executed on his browser.

SQL Injection

Hi today i am going to explain thing you have to know about SQL Injection.

1. What is SQL injection 
2. How it work  

1. What is SQL injection:-SQL injection is attack vector in which attacker directly execute SQL query to database from Vulnerable Web Application. Attacker can perform any sql query like select, update, create, delete type of query on Database. Sql Injection is not limited to gaining access to database it can also lead to compromising of Operating System. 
2. How it work: SQL injection work by breaking the original Sql query using OR,UNION,AND. 

For e.g.: If  Web Application is having form of Sign in where User enters Username and His Password  for authentication where following SQL Query is made by Web Applications.

User_table having following database

ID	USERNAME	PASSWORD
1	Admin	Admin
2	Vinesh	Security
3	Vin32	Vin32
4	Secure	Secure

 

Select * from User_table where Username="Vinesh" and Password="security"

What if attacker uses this functionality to performe Sql injection by breaking above sql query.

Attack vector:  "or 1=1--

When attacker uses this attack vector in Username field following query will execute by web application.

Select * from User_table where Username=" "or 1=1--and Password="security"

As you can see that the query is having blank username with or condition of 1=1 which is always true and comment out rest of the password part so it will not check for password field.

So attacker would logon with 1st username that is admin without entering any credential.

 Similar Attack Vector Used in Sql Injection

' or '1'='1' -- '
' or '1'='1' ({ '
' or '1'='1' /* ' 

Below mentioned are the Source code vulnerable to  SQL Injection.

Where user enters his id and get details of his firstname and lastname.

What if attacker use this feature and exploit using SQL Injection and get all the details of in database.

How to prevent SQL Injection

• Use of Prepared Statements (Parameterized Queries)
• Use of Stored Procedures
• Escaping all User Supplied Input
• Also Enforce: Least Privilege user
• Also Perform: White List Input Validation

Reference URL:

https://www.owasp.org/index.php/Query_Parameterization_Cheat_Sheet

https://www.owasp.org/index.php/SQL_Injection

Basics Of Computer Network?

What is a Computer Network?

A network is any collection of independent computers or devices that communicate with one another over a shared network medium or over the internet(BackBone).

First Freely Programmable Computer

The Z1 was a mechanical computer designed by Konrad Zuse completed in 1938.

History of the Internet
The history of the Internet starts in the 1950s and 1960s with the development of computers. This began with point-to-point communication between mainframe computers and terminals, expanded to point-to-point connections between computers and then early research into packet switching.
Arpanet was the first real network to run on packet switching technology (new at the time). On the October 29, 1969, computers at Stanford and UCLA connected for the first time. In effect, they were the first hosts on what would one day become the Internet.
The first message sent across the network was supposed to be "Login", but reportedly, the link between the two colleges crashed on the letter "g".

Wireshark Cookie Dump:

Wireshark Cookie Dump: