25 lines
1.3 KiB
Markdown
25 lines
1.3 KiB
Markdown
- Origin Domains
|
||
- Content Delivery Networks (CDNs) are used to deliver website content/traffic more efficiently and reduce server load.
|
||
- CDNs are *not* proxies for the real webserver--the real webserver is the origin.
|
||
- Oftentimes, CDNs will block security testing payloads. Find the origin server and bypass the filtering/CDN.
|
||
- Examples (for Akamai):
|
||
- `origin-sub.domain.com`
|
||
- `origin.sub.domain.com`
|
||
- Try sending `Pragma: akamai-x-get-true-cache-key` - key often has origin in it
|
||
- Things to look for:
|
||
- Logins
|
||
- Defaultcontent
|
||
- Bypass domains (dev, qa, ww1,ww2,)
|
||
- 302’s
|
||
- Basic Auth
|
||
- Old looking frameworks
|
||
- Outdated Priv Pol / Trademark
|
||
- Favicon analysis
|
||
- Useful when you have a *ton* of webservers to analyze - fingerprint by the favicon
|
||
- [FavFreak](https://github.com/devanshbatham/FavFreak)
|
||
- Reporting guidelines:
|
||
- Detailed enough to reproduce
|
||
- Record your proof in case the issue gets fixed before your submission is triaged
|
||
- Some orgs are more mature than others, it may take time – ask your triager
|
||
- Autogenerated / autosubmitted reports are obvious especially if they lack any good information
|
||
- Prove impact. Take it further if you can. Example: An XSS with a simple “alert(1)” could get you $50-100, but can you prove it’s more impactful? We love to see it! |