If you don't read this week's #BugBytes, you'll be missing a juicy file upload vulnerability to bypass AWS signing, Sam Curry's sensitive secrets and Sebastian Neef wordpress madness. Subscribe or miss out! 👇
go.intigriti.com/bugbytes-60
XXE
1. change password func -> JSON
2. converted to XML -> 200 OK
3. created dtd file on my ec2 and started webserver on port 80
4. crafted a XXE payload!
5. bounty!
Always convert POST/PUT/PATCH body to xml and resend req, don't forget to change the content-type.
#bugbountytips
