Bug Hunting Journal

Using the SQL Query to test for injection vulnerability, then proceeding with testing using sqlmap to confirm the vulnerability. Results indicated potential sensitive data extraction through improperly validated queries.

Attempting to predict the hash used in password reset URLs by analyzing hash formation patterns from several URL samples. The patterns found showed that the hash could be predicted with a certain level of accuracy due to the lack of random elements in its formation.

Identifying that CSRF tokens were not regenerated on each request, allowing the same token to be reused for multiple operations. This creates a security vulnerability where attackers can use the same token to perform actions on behalf of authenticated users.

Testing file upload vulnerabilities with techniques such as modifying file extensions to ".pdf.php" and performing MIME spoofing. Successfully uploaded PHP files that could be executed by the server through validation that only checked file extensions without in-depth content analysis.

Successfully capturing error and debug information from servers that provided clues about database structure and server configuration. This information could potentially be used to compose further attacks as it revealed file paths, software versions, and database structure.