 was on finding a way to create a valid prototype pollution payload to exploit SSRF and retrieve a secret flag.

We are glad to announce the #9 DOJO Challenge winners list.

The FIRST and 4 best quality write-up reports

 feeds to be notified of the upcoming challenges.

Read on to find the best write-up as well as the challenge author’s recommendations.

EvilCorp2.0 has a script to check the current state of an internal service. They want to make sure that this script, with all its security, cannot be used to retrieve the 

 path…Find a way to bypass all security mechanisms to retrieve the /secret.

We asked you to produce a qualified write-up report explaining the logic allowing such exploitation. This write-up serves two purposes:

Determine the contestant ability to properly describe a vulnerability and its vectors inside a professionally redacted report. This capacity gives us invaluable hints on your own, unique, talent as a bug hunter.

report was detailed, informative, and good at explaining the logic to construct the magic payload and to bypass every security mechanisms in script to finally obtain the secret flag hidden in /secret.

 were also very nice, we’re sorry can’t publish them all because that’s where you clearly witness the outstanding creativity of our community.

User-supplied parameters are used to build an URL which is then be fetched by the server. Even if some protections were added to prevent users from fetching arbitrary 

Indeed, the script does not properly check that the supplied parameters are strings, and passing Javascript objects allows to bypass the WAF and fetch an arbitrary resource.

The script executes the following function on the provided parameters to check for injection attempts such as path traversal:

Even if a check is performed to ensure that the parameter is not an array, nothing prevents from sending an object. For instance, the following payload passes the first check:

The payload can be modified to define an includes function that always returns false:

Similarly, the payload can also be modified to define an indexOf function that always returns 0:

Now, the script does not return an error, but it attempts to fetch http://localhost/[object%20Object]. We want to fetch http://localhost/secret. To achieve this, the payload can be modified to define a toString function that always returns secret:

Now, the path parameter was successfully injected, but there is a protection at the network level that returns this error:

To bypass this protection, the port parameter can also be injected with the value pw@127.0.0.1:5000. The final payload is the following:

Once parsed, the script will attempt to fetch the URL http://localhost:foo@127.0.0.1:5000/secret. In this case, localhost is the username and foo is the password that will be used to connect to 127.0.0.1, which is the same as localhost.

An attacker could perform an SSRF and force the server to execute arbitrary HTTP queries on internal hosts.

It is not sufficient to use the isArray method since it allows objects to be sent. Instead, the typeof operator could be used:

Furthermore, the port number should be an integer, not a string. A more secure way to build the URL would be using the URL function:

The DOJO #9 was using a “jsonify” filter, so as it was, the final payload from Remmer’s report could not work with this filter enabled, because the JSON was not valid. Because we appreciated Remmer’s writeup and explanations, that’s why we decided to publish it. After discussion with Remmer, we were able to validate the challenge and build the final payload, including the operation with the jsonify filter:

DOJO CHALLENGE #9 Winners!

Welcome to the first post in our tutorial series “How-To” dedicated to Burp Suite. In this tutorial we will create a modern burp extension using Kotlin. Why Kotlin? Burp is written in Java, but if you don’t like java (like me) you can use python or ruby to create an extension. I used to write my addons in python with Jython but Burp use Jython that only support Python2.7 which is now deprecated for more than a year. I could use Ruby but the extender API is very “

“, that make writing elegant code difficult when you mix multiple languages.

This tutorial series will teach you how to use burp API, not how to program in Kotlin. If you want to learn more about Kotlin, I strongly recommend 

In this prelude episode we will focus on the development environment setup. We are going to use IntelliJ IDEA. IDEA and Kotlin are both developed by JetBrains and work wonderfully together.

You can find all the code used in this tutorial on 

The first step is to install openjdk-14 and IntelliJ IDEA. We will use Ubuntu LTS 20.04 for this tutorial, if you use another OS or Linux distribution please refer to 

That’s it, you can now start IntelliJ IDEA.

Once it’s started, create a new Java project named MyAddon and add Kotlin support.

This will create the skeleton folder for your addon.

To create a burp extension we will need burp interface files, we can easily add them using maven.

Open the project settings via File / Project Structure, or by pressing ctrl+alt+shift+s and go to the Libraries tab.

Click on the + icon and choose From Maven...

Search for net.portswigger.burp.extender:burp-extender-api and install the latest version (2.1 here)

Now we have everything we need, we can start writing the actual code for the addon.

In order for Burp to find our extension we need to create a new package named burp with a class named BurpExtender implementing IBurpExtender interface.

Then, in this burp package create a new Kotlin class named BurpExtender

The BurpExtender class must implement a registerCallback function that will be called by burp, this is the entrypoint of your addon. Our first example is a simple hello world.

Now that our minimal extension is finish we need to build it into a jar file in order to load it into burp.

Go back to project structure ctrl+alt+shift+s on the artifact tab and create a new JAR from modules.

To create the jar file automatically for each build, don’t forget to check Include in project build

You can now build your project via the menu or by pressing ctrl+F9

The jar file will be available in $PROJECT_PATH/out/artifacts/MyAddon_jar/MyAddon.jar

Open burp and go to Extender/Extensions and click on add.
In the popup choose java as extension type and enter the path of the previously created jar file, then press next.

You can now see your extension with it’s name, and the messages in the Output and Errors tabs.

We got our first extension ready and running, even if it doesn’t do much for now. Tune in for next episode, we will explore Burp API and how to add UI components. Feel free to ask anything on our 

How-To: Learn how to write a Burp Suite extension in Kotlin – Setting up

, Europe’s leading crowdsourced security platform, today announced the launch of a public Bug Bounty program for 

. The national postal organisation was one of the first Swiss companies to start a private Bug Bounty program in 2020 to great success. It is now opening the program up to the entire 

Swiss Post is one of the oldest and best-known brands in Switzerland. In May 2020, the company decided to leverage the swarm intelligence of the YesWeHack community for the security of its digital products in addition to existing security tests. To do so, Swiss Post initially started with 20 selected ethical hackers and gradually invited more to join the vulnerability hunt. As a result, a few hundred ethical hackers are already bug hunting for the private program.

“Since the beginning of the program, we have identified 500 vulnerabilities and paid out almost CHF 250,000 in rewards.” says 

Marcel Zumbühl, Chief Information Security Officer at Swiss Post

Public program gives access to 23,000 hackers

Following the success of the private program, Swiss Post is going one step further. The online services previously tested in the private program are now being transferred to a public program. Ethical hackers could previously search for security vulnerabilities by invitation only. From now on, all 23,000 ethical hackers from the YesWeHack community can participate in the program. In return, they will receive up to €10,000 in rewards for a critical vulnerability. The 

 will initially start with eleven scopes, which have already had their security posture enhanced by the private one. There are plans to add more services to the program.

All services that are not yet part of Swiss Post’s public Bug Bounty program can also have vulnerabilities be reported to Swiss Post via a 

 (VDP). The VDP serves as a communication channel and offers security researchers an orderly, legally secure framework for vulnerability reporting.

Clear benefits of Bug Bounty: crowd power and transparency

“Bug Bounty applies the principle of crowdsourcing to cybersecurity. Through the YesWeHack platform, companies gain access to several thousand ethical hackers who offer a versatile range of skills to cover the full spectrum of testing functions,” explains

. “In addition, public Bug Bounty programs provide transparency and trust to customers. They demonstrate a company’s commitment to its information security and the protection of its users’ data. We are very pleased that Swiss Post, as one of the largest Swiss companies, counts on YesWeHack to help them make their digital products even more secure.”

Check out Swiss Post’s public Bug Bounty program 

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private and public programs for hundreds of organizations worldwide in compliance with the strictest European regulations.

In addition to the Bug Bounty platform, YesWeHack also offers: support in creating a 

, a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Want to discuss crowdsourced security with our experts?

Swiss Post launches public Bug Bounty program with YesWeHack

, the leading European drone group, is launching its Bug Bounty program with 

, the first European crowdsourced security platform.


Through this partnership, Parrot benefits from 

’s vast community of cybersecurity researchers to identify potential vulnerabilities in its drones, mobile applications and WebServices.

 will initially give exclusive access to selected security researchers and will include future Parrot drone models. The expertise and diverse skills of the researchers will confirm the high level of security of the products before they are marketed, for the greater benefit of Parrot users’ security and the protection of their data.

– After a first phase in a private Bug Bounty program, and after being commercialized, the products will enter a

. Their security will then be scrutinized by the entire YesWeHack community, representing more than 22,000 cybersecurity researchers.

Cybersecurity is a priority for Parrot. Parrot provides its users with full transparency on the security of their data and has conducted numerous security audits on its products, both internally and by its customers. The complete assessment conducted by Bishop Fox, one of the most recognized private companies for professional offensive security services, is published on its 

“After the integration of cybersecurity from the initial design phase of Parrot drones, the Bug Bounty launched with YesWeHack completes the audits and brings an additional step of control. In the event of a flaw, YesWeHack’s community of cybersecurity researchers will detect it and allow Parrot to correct it, before real attackers can misuse it.”

, Chief Security Officer and CTO Cybersecurity of the Parrot Group.

“We are delighted to support Parrot in its commitment to the drone and user’s data security. The richness and diversity of the YesWeHack community offers the spectrum of skills required to cover the full range of perimeters, whether hardware or applications. The public Bug Bounty phase, which will take place in a second phase, will allow Parrot’s products to be confronted with the expertise of several thousand researchers, thus reinforcing its transparency in cybersecurity.”

Founded in 1994 by Henri Seydoux, Parrot is today the leading European group in the fast-growing industry of drones. Visionary, at the forefront of innovation, Parrot is the only group to be positioned across the entire value chain, from equipment to services and software. Parrot, the world’s number 2 of the consumer drone market, designs drones known for their high performance and ease of use. Parrot has a portfolio of outstanding companies and interests in commercial drones, covering equipment, software and services. Its expert capabilities are focused primarily on three vertical markets: (i) agriculture, (ii) 3D Mapping, Surveying and Inspection, and (iii) Defense and Security.

The Parrot Group designs and engineers its products in Europe, mainly in France and Switzerland. It currently employs over 500 people worldwide and makes the majority of its sales outside of France. Parrot, headquartered in Paris, has been listed since 2006 on Euronext Paris (FR0004038263 – PARRO). Financial information can be found on http://corporate.parrot.com. For more information: 

In addition to the Bug Bounty platform, YesWeHack also offers: support in creating a 

, a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Parrot launches its Bug Bounty in partnership with YesWeHack

 was on finding a way to bypass 3 security mechanisms to prevent a SSRF and to retrieve a secret flag.

We are glad to announce the #8 DOJO Challenge winners list.

‘sreport was detailed, informative, and good at explaining the logic to bypass every security mechanisms in script to finally obtain the secret flag hidden in /secret.

‘s were also very nice, we’re sorry can’t publish them all because that’s where you clearly witness the outstanding creativity of our community.

For the latest addition to the Dojo series, we’re faced with the challenge of fetching the secret that EvilCorp2.0 is storing on the /secret endpoint. To obtain this secret, we need to find a way through the security mechanisms that EvilCorp2.0 has put in place for their small app. Their app is created using Deno (https://deno.land/) and allows us to specify a URL as a string, which the server will fetch for us if it passes the security mechanisms.

The security mechanisms are implemented as a function called waf. The function takes a parameter of type ‘string’ called str. The function starts by creating a URL object named url by using the user-provided string:

The rest of the function implements 5 security mechanisms which do the following:

Skips all security checks if str (not the URL object) is equal to http://127.0.0.1:5000/ping

2. Makes sure that the port from url.port is 5000

4. Makes sure that url.pathname starts with /ping

 contain the substring /ping<ANY_CHARS>/.
The following would eg. not pass: http://example.com/smth/pingblabla/hihi

We now have a basic understanding of the app, so let’s exploit it! Let’s start by providing the string http://127.0.0.1:5000/ping which we now will pass the security mechanisms because of check 1 in waf

Cool, we got a ‘pong’ from the /ping endpoint. Let’s now bypass some of the security mechanisms! There doesn’t seem to be a reason we would want to bypass the ‘port’ check since we assume that the /secret endpoint exists on port 5000, so let’s move on to check 3. Hmm, this seems to be a pretty insufficient way to avoid requests to localhost. While we can’t use 127.0.0.1 or localhost, there's plenty of other options out there that will resolve to localhost. Simply '0' would often do! Let's try using the payloadhttp://0:5000/ping` to see if we can bypass this check and receive a ‘pong’:

Yup, it worked! Nice, let’s move on then. Check 4 ensures that the pathname property of the url object starts with the value /ping. This seems pretty hard to work around, but there’s one important thing to notice in the app’s logic! Notice that the url object only exists within the scope of the waf function, and that it’s actually the string, which is also named url (confusing, huh?) that’s provided as a parameter to fetch after the waf function is passed.

So why care about this? Well, wouldn’t it be nice if there was some inconsistency between the URL object in Deno and the user-provided string! What if eg. the pathname property of the URL object didn’t match the actual path being fetched when sending a request to the user-provided string? In other words: Can we craft a payload, which when used to create a URL object, causes some unexpected behavior?

Let’s create a test environment to test for inconsistencies in the Deno URL object. To do so, we can simply use the Dojo Playground!

We now have a simple app that logs the value of url.pathname for us. Time to test! Maybe some simple path traversal trick will do the job?

Hmm, sadly no. But maybe we could try and do some URL-encoding? But first, a quick example. Visting a URL like: https://example.com/ping/%2e%2e%2fhihi from most browsers would result in the following:

As we can see, we didn’t end up on /hihi but /ping/..%2fhihi instead. But the notice how the period chars were decoded… What would happen if we instead visited https://example.com/ping/%2e%2e/hihi? You guessed it:

The path was resolved to /hihi. Let’s try to apply this knowledge to our Deno test set-up and use the payload: http://0:5000/ping/%2e%2e/secret:

Would you look at that! Deno didn’t seem to care about our URL encoded period chars, and tells us that the pathname is simply /ping/%2e%2e/secret. But what will happen when we fetch this payload..?

Let’s head back to the challenge and find out!

Oh, we forgot about the last check… We can’t use any / chars after the string /ping. But could we maybe just use something else than / ? Well, how about some nice \ ! Let’s try with the payload http://0:5000/ping\%2e%2e\secret:

Voilà!🎉 We solved the challenge and retrieved the secret: flag{You just found a secret !}

Thanks for reading along!
Happy hacking,
holme

DOJO CHALLENGE #8 Winners!

You don’t stay ahead by standing still. Here at 

 we are continually innovating, exploring new ways to enhance the 

 platform, so you can identify, track, and triage bugs faster and more securely. And ultimately launch smarter software solutions ahead of rivals.

 introduces several new features, strengthening the platform’s position as a best-in-class vulnerability management and bug tracking integration solution.

First and most importantly, we’ve added even more flexibility into the reporting capability. In YesWeHack Tracker 2.1, we are closing the DevSecOps loop flow with feedback from development teams to security teams. Previously in 

, information flowed only in one direction – from security teams to development teams. Now it is bi-directional, enabling teams to collaborate seamlessly with one another on vulnerability reports, comments, feedback, and other insights.

Development teams, for example, can now share insights that confirm a problem is fixed and closed. That way, the researchers who discovered the bug can move on to test it – attempting to find a workaround that exploits the vulnerability. They may report that the fix works, or that there’s still a bypass that compromises the application. Agility is the watchword here: making it faster and easier for DevSecOps teams to collaborate and build a security foundation into DevOps initiatives.

Release 2.1 takes this control and collaboration into other dimensions too. Managers have complete control over who sees what and when. The manager can decide, for example, whether or not comments derived from the development team are included in the reporting. Researchers only see what the managers sanctions. This way, teams are not overwhelmed with irrelevant insights – they only see the issues relevant to their role, streamlining the vulnerability management process.

 Tracker is as intuitive as always – everything you need is available in a single, unified interface for faster, more intuitive DevSecOps. You simply set your credentials, and YesWeHack Tracker connects to your chosen bug tracker(s), whether it is GitHub, GitLab, Jira, or Jira Cloud. For example, you can set one program to connect with Jira, another to go to GitLab. You can select all comments to be posted to the GitLab bug tracker. Likewise, on one of the bug trackers, you could choose to synchronise only comments and not feedback. It’s all about total control from one interface.

2020 was a year of unprecedented change and uncertainty. 2021 is quickly evolving into more of the same. In this dynamic landscape, you need the trusted technologies at your fingertips to develop secure, customer-focused applications at the speed of business. The 

 Tracker 2.1 offers turnkey, seamless, and secure integration with your preferred bug tracking toolset, boosting the strength and scope of your vulnerability management strategy.

With the latest release – and still more features in the pipeline – your business is uniquely positioned to connect with deployed bug trackers more easily and communicate vulnerabilities, remediate issues, and ensure swift bug resolution and closure.

’s plug-and-play bug tracking integration solution can help drive smarter DevSecOps communication and collaboration

Please visit our Changelog for all feature updates

Interested in knowing more about our vulnerability management integration solutions?

 offers companies an innovative approach to cybersecurity with 

 (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.YesWeHack runs private (invitation based only) programs and public programs for hundreds of organizations worldwide in compliance with the strictest European regulations.

 platform, YesWeHack also offers: support in creating a 

YesWeHack Tracker 2.1 – it’s all about communication and collaboration

Tesla upending more than a century of automotive tradition. Uber redefining the taxi market. Airbnb reinventing the way we book vacations. Each one disrupting the market it operates in – not in decades, but in years. The lesson to learn? For a business to survive, it needs to be infinitely agile and adapt at pace to market change.

However, there’s a balance to be struck between speed and security. To deliver those trusted applications more quickly, organisations need to bake robust application and infrastructure security at the start, closing the vulnerabilities criminal hackers will target across the expanding attack surface.

Until now, most organisations have relied on penetration testing or ‘pen-tests’, to search for vulnerabilities in applications. However, the approach is proving itself increasingly obsolete in today’s dynamic, digital world.

First, pen-tests are limited with regards to the skills mobilized. The consultants involved typically lack the relevant skills and struggle to master the technical environments associated with the tests and the potential attack techniques. Second, most pen-tests are invariably one-off, time-boxed processes, performed one or two weeks per year – not practical when serious or critical vulnerabilities often take several weeks to be discovered. Finally, annual (or even biannual) audits do not meet the growing need for speed and continuity that is typical of agile approaches.

A European financial institution, for example, recently reported, “We can’t be agile when we’re doing pen tests; it doesn’t work. There are too many projects to follow, and we can’t do one before each roll-out owing to the lack of time, responsiveness, and means. The deadlines are too tight and the tests have to be scheduled several times a year.”

A transformative cybersecurity approach is disrupting pen-testing, just as Tesla, Uber, and others have disrupted their respective markets. It’s called 

A Bug Bounty platform provides augmented crowdsourced pen testing as a service. It is an agreement whereby organisations reward ethical hackers – or ‘researchers’ – for reporting bugs, especially those pertaining to security exploits and vulnerabilities. The more severe the reported bug, the higher the reward.

The market is marching towards Bug Bounty platforms too: 

 predicts that by 2022 -that’s next year-, 50% of organisations will be using this modern approach to cybersecurity.

So how does a Bug Bounty platform provide the operational agility to cope with today’s ultra-fast pace of change?

A Bug Bounty platform delivers flexibility, streamlining trusted cybersecurity processes, so organisations can release applications into production more quickly. Take the example of a company using DevOps. They need continuous testing alongside continuous integration/delivery since they’re delivering code every day. A Bug Bounty program provides that continuous testing: surfacing bugs at the same speed as they are inadvertently created by the development teams.

Likewise, organisations using the more traditional waterfall methodology are under pressure to release code in weeks not months as before. Scheduling old-school pen-tests so frequently is not an option. Now, they can use a Bug Bounty platform to mobilize a hand-picked team of ethical hackers to surface bugs during the pre-production acceptance or testing phase.

A Bug Bounty platform increases agility by empowering security and development collaboration. It’s a given that organisations are growing their development community to meet the demand for faster application delivery. In turn, developers are being given more autonomy and typically outnumber security professionals by a significant margin. Unless the security team can find a way to embed security early in that development process, they end up losing control of the security process, with all the inherent risk of vulnerabilities.

Here, a Bug Bounty platform embeds security processes directly into development, increasing collaboration. For example, developers can communicate directly with the researchers who find the bugs – increasing awareness of security and enabling skills transfer between the hunters and the developers. Organisations can ultimately create security champions among the development teams.

A Bug Bounty platform automates multiple vulnerability management processes, increasing speed and agility. With pen testing, for example, organisations only receive a static pdf report. With a Bug Bounty platform, security and development teams can easily 

 all the data into their chosen bug tracker to manage vulnerabilities at scale and speed. There’s no manual ‘copy and pasting’ of content – teams are connected to a single, complete view of the workflow and data.

 is a leading global Bug Bounty & VDP Platform. More than 400 programs – private and public – are in operation, spanning 30+ countries. 

 is also number one among the research community: tens of thousands ethical hackers rely on the platform, in more than 170 countries.

To learn how YesWeHack’s Bug Bounty Platform can help your organization deliver agile digital transformation and pivot to growth, book a free consultation with one of our experts.

Achieve Agile Transformation with a Bug Bounty Platform

 was on finding a valid WAF bypass to exploit an XSS on prototype pollution vulnerability.

We are glad to announce the #7 DOJO Challenge winners list.

You had an input field that you could inject, but many characters were sanitized and the WAF could detect them. The goal was to get around that WAF and find a way to exploit an XSS.

‘sreport was detailed, informative, and good at explaining the WAF exploitation logic.
The others reports, notably 

‘s were also very nice, we’re sorry can’t publish them all because that’s where you clearly witness the outstanding creativity of our community.
Thank you all for playing with us!

Website allow user to control a JavaScript variable named “config” which can be used to perform reflected XSS.
It is noted that a “WAF” is in place to avoid XSS but can be bypassed.

Website allow user input with almost no restriction to take place in a JavaScript variable.

User input is expected to be valid JSON which restricts a bit the allowed charset and forbid usage of JavaScript features such as functions.

The “WAF” in place forbid characters such as ["<", ">", "'", '"', "?"], which would be enough to restrict XSS if previous checks were not hijackable.

The main issue lie in the function isObject() which is bypassable because user can modify the JavaScript object prototype and masquerade as another type by declaring a property
__proto__ such as config = {"__proto__": {}}

Once type check bypassed, the control loop over forbidden characters was not working anymore because of missing includes function on object. This could be fixed by using Array prototype on config object such as
config = {"__proto__": []}, which has an includes function (See [1]) and is then inherited by config object allowing to bypass the loop.

Now that the config object can pass through the “WAF” without issues, we can add a payload with JavaScript code execution inside name property such as
{"name": "<script>alert(1)</script>".

Input following payload in $config field:
{"__proto__":[], "name": "<script>alert(1)</script>"}

JavaScript has a lot of quirks and will have many more, it is generally unsafe to consider that you can “control” an almost fully controlled user input variable. Though, to fix the isObject function it might be better to rely on instanceof JavaScript keyword.

In all case, use a sanitization library such as DOMPurify before returning/interpreting user controlled input. See [3].

[1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/includes

[2] https://developer.mozilla.org/fr/docs/Web/JavaScript/Reference/Operators/instanceof

DOJO CHALLENGE #7 Winners!

 with a new article about an extension known by many hunters but still (too) rarely used, AutoRepeater. If you use Burp Suite for your hunting session, you probably already know the “

” feature. This one is useful, but with the AutoRepeater add-on, you can extend the possibility of automation to focus more on research and exploits.

” functionality in Burp Suite works fine and can do the job in many cases. But when you need to go deeper in your testing phase, you are limited to some basic features. We will try to see how we can improve this!

The plugin is available on BApp Store but we recommend downloading and installing it directly from the GitHub repository which have a more recent version: 

Once you have downloaded the package, unzip it. Now, open Burp Suite: 

. After the installation, you should see a new tab, we can now start to use the plugin!

The interface is pretty clear and we rapidly understand how this plugin works:

: request header, body, param name, but also, cookie name, cookie value, string, first line, remove parameter by name, by value, matching param name and replace value…

: boolean operators, multiple match type (domain name, HTTP method, protocol, file extension, URL, sent from tool… and many more)

: add a filter to show only interesting requests with a specific behavior in your testing process (filter can be applied on URL, request header, request body, file extension…)

: adding colors on specific requests which match with a string, request, param, extension, HTTP method…

Request & Response viewer with original and modified request

Diff between (for requests and responses)

Let’s imagine we have a target with a UUID or an userId: as a hunter with eagle eye, you will probably want to test if two accounts can use or access the IDs from another account, and vice versa. Depending on your target, these IDs can appear multiple time in your requests, so when you want to test IDOR and 

 bugs, you will perform multiple tests by replacing all IDs or just the first one.

How to do thin on AutoRepeater? Add a new 

and select the type of string that you want to replace in “Match”. Choose the value that you want to replace. Select “

” to choose the replacement mode. And that’s all.

Be as creative as possible, here are examples of which rules can be created:

Add new headers (x-forwarded-for, x-forwarded-host, origin…),

Remove authentication header or cookie (JWT for example),

Change HTTP Method (PUT to POST or vice versa),

Math parameters for Open Redirect, reflected XSS or SSRF

Try to bypass “403 Forbidden” by adding specific headers or things like “.;/” in URL

Chain AutoRepeater with Hackvertor extension

: for each replacement configured in AutoRepeater, a new request will be generated, this can therefore quickly become unreadable. Luckily, there is a feature to highlight requests, and this is what we will see right now.

AutoRepeater has a “Log Highlighter” feature which can be used with conditional match, to highlight only what you exactly want. For example, only match “200 OK” status or if HTTP method is “PUT” or “POST”. To configure this, go on 

. You will be able to configure a new rule with specific match conditions.

The “Log Filter” feature can be used to have a clearer view on your requests. As others features, you can add a new rule but with a “Blacklist” or “Whitelist” mode.

The YesWeHack Blog

DOJO CHALLENGE #9 Winners!

How-To: Learn how to write a Burp Suite extension in Kotlin – Setting up

Swiss Post launches public Bug Bounty program with YesWeHack

DOJO CHALLENGE #9 Winners!

Parrot launches its Bug Bounty in partnership with YesWeHack

DOJO CHALLENGE #8 Winners!

YesWeHack Tracker 2.1 – it’s all about communication and collaboration

Parrot launches its Bug Bounty in partnership with YesWeHack

Achieve Agile Transformation with a Bug Bounty Platform

DOJO CHALLENGE #7 Winners!

PimpMyBurp #3 – AutoRepeater: add automation to your beautiful hunter life

Achieve Agile Transformation with a Bug Bounty Platform

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us