1.3 KiB
1.3 KiB
- Origin Domains
- Content Delivery Networks (CDNs) are used to deliver website content/traffic more efficiently and reduce server load.
- CDNs are not proxies for the real webserver--the real webserver is the origin.
- Oftentimes, CDNs will block security testing payloads. Find the origin server and bypass the filtering/CDN.
- Examples (for Akamai):
origin-sub.domain.comorigin.sub.domain.com- Try sending
Pragma: akamai-x-get-true-cache-key- key often has origin in it
- Things to look for:
- Logins
- Defaultcontent
- Bypass domains (dev, qa, ww1,ww2,)
- 302’s
- Basic Auth
- Old looking frameworks
- Outdated Priv Pol / Trademark
- Favicon analysis
- Useful when you have a ton of webservers to analyze - fingerprint by the favicon
- FavFreak
- Reporting guidelines:
- Detailed enough to reproduce
- Record your proof in case the issue gets fixed before your submission is triaged
- Some orgs are more mature than others, it may take time – ask your triager
- Autogenerated / autosubmitted reports are obvious especially if they lack any good information
- Prove impact. Take it further if you can. Example: An XSS with a simple “alert(1)” could get you $50-100, but can you prove it’s more impactful? We love to see it!