Bug Bounty Tips(10-26 2022)

Bug Bounty Tips(10-26 2022)

Github Recon

Heroku配置文件中敏感信息泄露

cloud/heroku.json中包含了Heroku配置文件中敏感信息

org:company filename:heroku.json

org:company HEROKU_API_KEY OR HEROKU_KEY

user:name filename:heroku.json

user:name HEROKU_API_KEY OR HEROKU_KEY

"company.com" HEROKU_API_KEY OR HEROKU_KEY

示例:

{
    "heroku": {
      "HEROKU_EMAIL": "[email protected]",
      "HEROKU_API_KEY": "7a2f9a4289e530bef6dbf31f4cbf63d5"
    }
  }

PostgreSQL文件中密码泄露

db/.pgpass:PostgreSQL文件中密码泄露

org:company filename:.pgpass

org:company :database:

user:name filename:.pgpass

user:name :database:

"company.com" :database:

示例:

#hostname:port:database:username:password
localhost:5432:database:root:password

Recon

使用HTTPX进行端口探测、扫描以及目录暴力破解的shell脚本:

cat domains | httpx -nc -silent -p 80,443,8080,8443,9000,9001,9002,9003 -path wordlist.txt -fc 400,404,403 -title -content-length -ip -status-code -server 

AWS 测试的一个 checklist