YoKo Kho

Category: Web Apps

Collection of the bug that specifically found at web application

From Recon to Bypassing MFA Implementation in OWA by Using EWS Misconfiguration

A story about how I Finally could use an AD account that unenrolled to MFA, by using an EWS Misconfiguration to Access Email Inbox and (Having...

June 19, 2020

Intercept Server Responses Feature on Burpsuite

Bug Report / Web Apps / Write-Up

From 3,99 to 1,650 USD (Part I) – Simple Vertical Privilege Escalation by Changing HTTP Response

A story about how I got several simple bugs (1 P2, 1 P3, and 2 P4s) on a target (that just allow Specific Country Code to...

June 6, 2020

Bug Report / Web Apps / Write-Up

From Recon to Optimizing RCE Results – Simple Story with One of the Biggest ICT Company in the World

How I Finally could Got into an Internal Network (and could accessing all of their internal assets) at One of the Biggest ICT company in the...

February 19, 2020

Bug Report / Web Apps / Write-Up

Race Condition that could Result to RCE – (A story with an App that temporary stored an uploaded file within 2 seconds before moving it to Amazon S3)

In the name of Allah, the Most Gracious, the Most Merciful. – Part I from (hopefully) IV Parts – Update I: Added a “Reference” Section. Update...

September 14, 2019

Bug Report / Web Apps / Write-Up

IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple:[English Version] IDOR...

April 17, 2018

Bug Report / Web Apps / Write-Up

Ribose – IDOR with Simple CSRF Bypass – Unrestricted Changes and Deletion to other Photo Profile

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple:[English Version] Ribose — IDOR...

April 16, 2018

Bug Report / Web Apps / Write-Up

Bypassing the Current Password Protection at PayPal Tech-Support

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release (December, 2017 Article):[English Version]...

December 26, 2017

Bug Report / Web Apps / Write-Up

Information Disclosure at PayPal and Xoom (PayPal Acquisition) via Simple Google Dork – 1,000 USD

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release:[English Version] PayPal – Information...

December 26, 2017

Bug Report / Web Apps / Write-Up

Turning Self-XSS into non-Self Stored-XSS via Authorization Issue at “PayPal Tech-Support and Brand Central Portal”

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release:[English Version] PayPal — Turning Self-XSS into...

November 12, 2017

Bug Report / Web Apps / Write-Up

FortiNet – Unrestricted Deletion to All Other Sub Account via IDOR at Support Portal

In the name of Allah, the Most Gracious, the Most Merciful. Please kindly visit this simple paper directly to looking this release in simple:[English Version] FortiNet...

May 3, 2017

Latest Tweets

Retweet on Twitter YoKo Kho Retweeted

Black Hills Information Security @BHinfoSecurity·

September 29, 2020

***NEW***
BHIS | Tester's Blog

Exploiting MFA Inconsistencies on Microsoft Services
by: @dafthack
Published: 9/29/2020

Learn more: https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/

Twitter 1310934952616353795

Retweet on Twitter YoKo Kho Retweeted

Tom Sellers @TomSellers·

September 29, 2020

Speaking of Exchange, we took another look at Exchange CVE-2020-0688 (any user -> SYSTEM on OWA).

It's STILL 61% unpatched.

This is dangerous as hell and there is a reliable Metasploit module for it.

See the UPDATED information on the ORIGINAL blog:
https://blog.rapid7.com/2020/04/06/phishing-for-system-on-microsoft-exchange-cve-2020-0688/

Twitter 1310991824828407808

Retweet on Twitter YoKo Kho Retweeted

The Bug Bounty Hunter @tbbhunter·

September 29, 2020

Jailbreaking iOS without a Mac (1/4): The Plan

https://medium.com/bugbountywriteup/jailbreaking-ios-without-a-mac-1-4-the-plan-b49c0edc1759

Twitter 1311033620254142464

Retweet on Twitter YoKo Kho Retweeted

The Bug Bounty Hunter @tbbhunter·

September 29, 2020

Dropbox Escalation of Privileges to SYSTEM on Windows

https://dreamlab.net/en/blog/post/dropbox-escalation-of-privileges-to-system-on-windows/

Twitter 1310922791525416960

Retweet on Twitter YoKo Kho Retweeted

Zero Day Initiative@thezdi·

September 29, 2020

Two different RCE bugs in #IBM #WebSphere are detailed by @zebasquared in his latest blog. Read the root cause and see video demos of CVE-2020-4464 and -4448 at https://bit.ly/33eQK2S

Twitter 1310992105628721153

Category: Web Apps

From Recon to Bypassing MFA Implementation in OWA by Using EWS Misconfiguration

From 3,99 to 1,650 USD (Part I) – Simple Vertical Privilege Escalation by Changing HTTP Response

From Recon to Optimizing RCE Results – Simple Story with One of the Biggest ICT Company in the World

Race Condition that could Result to RCE – (A story with an App that temporary stored an uploaded file within 2 seconds before moving it to Amazon S3)

IDOR (at Private Bug Bounty Program) that could Leads to Personal Data Leaks

Ribose – IDOR with Simple CSRF Bypass – Unrestricted Changes and Deletion to other Photo Profile

Bypassing the Current Password Protection at PayPal Tech-Support

Information Disclosure at PayPal and Xoom (PayPal Acquisition) via Simple Google Dork – 1,000 USD

Turning Self-XSS into non-Self Stored-XSS via Authorization Issue at “PayPal Tech-Support and Brand Central Portal”

FortiNet – Unrestricted Deletion to All Other Sub Account via IDOR at Support Portal

Search

Recent Posts

Categories

Latest Tweets