Code

[pull] master from bugcrowd:master#26

Code

Merged

pull[bot] merged 115 commits intobbhunter:masterbbhunter/templates:masterfrom bugcrowd:masterbugcrowd/templates:masterCopy head branch name to clipboardMay 15, 2024

+120-101

Commits

Commits on Apr 11, 2023

• Broken Auth and Session Management

  Show description for 0a7e856
  RRudder

  committed
  0a7e856

  Copy full SHA for 0a7e856

Commits on Apr 27, 2023

• Updated recommendation.md for malformed iOS URL Schemes

  RRudder

  committed
  f1bcf2b

  Copy full SHA for f1bcf2b

Commits on Apr 28, 2023

• Updated recommendation for Weak login function for non-operational endpoint

  RRudder

  committed
  96f6833

  Copy full SHA for 96f6833

• Updates to recommendations for All three session fixation variants

  Show description for 686f397
  RRudder

  committed
  686f397

  Copy full SHA for 686f397

Commits on May 2, 2023

• Updated rec for Failure to Invalidate Session on Logout

  RRudder

  committed
  dc56d05

  Copy full SHA for dc56d05

• update rec for Failure to Invalidate Session on Logout Server-Side Only

  RRudder

  committed
  3f152bd

  Copy full SHA for 3f152bd

• Updated rec for Failure to Invalidate Concurrent Sessions on Logout

  RRudder

  committed
  334c672

  Copy full SHA for 334c672

• updated rec for Failure to Invalidate session upon 2FA activation or change

  RRudder

  committed
  eb6ce09

  Copy full SHA for eb6ce09

• Updated rec for Failure to Invalidate Session for Long Timeout

  RRudder

  committed
  54b7217

  Copy full SHA for 54b7217

Commits on May 5, 2023

• Update recommendations.md

  RRudder

  authored
  df48a5d

  Copy full SHA for df48a5d

• Update recommendations.md

  RRudder

  authored
  03a025e

  Copy full SHA for 03a025e

• Update recommendations.md

  RRudder

  authored
  3142063

  Copy full SHA for 3142063

• Update recommendations.md

  RRudder

  authored
  acbaad5

  Copy full SHA for acbaad5

Commits on May 8, 2023

• Updates to rec for Self-Stored XSS

  RRudder

  committed
  9784af0

  Copy full SHA for 9784af0

• update rec for self-reflected XSS

  RRudder

  committed
  8fddd1d

  Copy full SHA for 8fddd1d

• Updates to rec for Flash-Based XSS

  RRudder

  committed
  03888ac

  Copy full SHA for 03888ac

• Updates to recs for cookie-based XSS

  RRudder

  committed
  2e0b1e1

  Copy full SHA for 2e0b1e1

• updates to rec for TRACE method XSS

  RRudder

  committed
  0846829

  Copy full SHA for 0846829

Commits on May 10, 2023

• Updates to rec for Plaintext Password Field

  RRudder

  committed
  dab28e9

  Copy full SHA for dab28e9

• update rec for Save Password

  RRudder

  committed
  d7f0284

  Copy full SHA for d7f0284

• update rec for Autocomplete Enabled

  RRudder

  committed
  121ad15

  Copy full SHA for 121ad15

• update rec for Autocorrect Enabled

  RRudder

  committed
  8fdae46

  Copy full SHA for 8fdae46

• updates to rec for CSV Injection

  RRudder

  committed
  3ddb369

  Copy full SHA for 3ddb369

• Updates to System Clipboard Leaks

  Show description for 3759f5c
  RRudder

  committed
  3759f5c

  Copy full SHA for 3759f5c

• Update rec for User Password Persisted in Memory

  RRudder

  committed
  280a1cc

  Copy full SHA for 280a1cc

Commits on May 11, 2023

• Updates to Sensitive Application Data Stored Unencrypted

  RRudder

  committed
  1ccff46

  Copy full SHA for 1ccff46

• Updates to rec for Non-Sensitive data store unencrypted

  RRudder

  committed
  dcbec4b

  Copy full SHA for dcbec4b

• Update to rec for Executable Download

  RRudder

  committed
  59cf6f9

  Copy full SHA for 59cf6f9

• Update rec for Weak Password Policy

  RRudder

  committed
  66a2cf6

  Copy full SHA for 66a2cf6

• Updates to Weak Password Policy

  Show description for 5be1c03
  RRudder

  committed
  5be1c03

  Copy full SHA for 5be1c03

Commits on May 15, 2023

• Updates to rec and template for Verification of Contact Method not Required

  RRudder

  committed
  d567658

  Copy full SHA for d567658

• update rec for Registration Allows for Disposable Email Addresses

  RRudder

  committed
  736bf90

  Copy full SHA for 736bf90

• Updated rec for Missing 2FA failsafe

  RRudder

  committed
  2e046b2

  Copy full SHA for 2e046b2

• update rec for 2FA Code is Not Updated

  RRudder

  committed
  cc9702e

  Copy full SHA for cc9702e

• Update rec for Old 2FA Code is Not Invalidated

  RRudder

  committed
  aed70f9

  Copy full SHA for aed70f9

• Updates to rec for Telnet Enabled

  RRudder

  committed
  938532f

  Copy full SHA for 938532f

Commits on May 16, 2023

• Updates to rec for Intentionally Public secrets

  RRudder

  committed
  42e28de

  Copy full SHA for 42e28de

• Updates to rec for Data Traffic Spam

  RRudder

  committed
  44a8be9

  Copy full SHA for 44a8be9

Commits on May 17, 2023

• Update rec for Non-Corporate User

  RRudder

  committed
  00fcad5

  Copy full SHA for 00fcad5

• Update rec for Full Path Disclosure

  RRudder

  committed
  ab0d540

  Copy full SHA for ab0d540

• Update to rec for Descriptive Stack Trace

  RRudder

  committed
  df673eb

  Copy full SHA for df673eb

• update rec for Disclosure of Known Public Information

  RRudder

  committed
  b8acc4c

  Copy full SHA for b8acc4c

• update rec for token leakage via referer trusted 3rd party

  RRudder

  committed
  66178be

  Copy full SHA for 66178be

Commits on May 19, 2023

• Update to template for Sensitive Token in URL in background request

  RRudder

  committed
  da33b92

  Copy full SHA for da33b92

Commits on May 24, 2023

• Update template.md for Cache Control of a Sensitive Page

  Show description for f96c2fa
  RRudder

  authored
  f96c2fa

  Copy full SHA for f96c2fa

Commits on May 25, 2023

• Updates to Non-Sensitive Token in URL

  Show description for 2a12cbc
  RRudder

  committed
  2a12cbc

  Copy full SHA for 2a12cbc

• Updates to rec for OAuth Secrets Hardcoded

  RRudder

  committed
  2316c24

  Copy full SHA for 2316c24

• Minor grammar update to File path hardcoded

  RRudder

  committed
  a83fb61

  Copy full SHA for a83fb61

• Minor updates to Internal IP address Disclosure

  Show description for 583f318
  RRudder

  committed
  583f318

  Copy full SHA for 583f318

• Updates to JSON hijacking

  Show description for 41dabca
  RRudder

  committed
  41dabca

  Copy full SHA for 41dabca

Commits on Jun 2, 2023

• Update to non-sensitive Directory Listing Enabled

  RRudder

  committed
  9854ff3

  Copy full SHA for 9854ff3

Commits on Jun 14, 2023

• Update recommendations.md for Lack of Exploit Mitigations

  RRudder

  authored
  baa6d66

  Copy full SHA for baa6d66

• Update recommendations.md

  Show description for e194cfa
  RRudder

  authored
  e194cfa

  Copy full SHA for e194cfa

• Update recommendations.md for Jailbreak detection

  RRudder

  authored
  7e48f52

  Copy full SHA for 7e48f52

• Update recommendations.md for Lack of Obfuscation

  RRudder

  authored
  46008a9

  Copy full SHA for 46008a9

Commits on Jul 31, 2023

• Update Steps to Repro for GET based open redirects

  RRudder

  authored
  d3c28ee

  Copy full SHA for d3c28ee

• Minor update to wording GET based open redirect

  RRudder

  committed
  cc63b20

  Copy full SHA for cc63b20

Commits on Sep 14, 2023

• Reworded template and guidance text for clarity

  RRudder

  committed
  e038b69

  Copy full SHA for e038b69

• Grammar fix in template

  RRudder

  authored
  1e73b3b

  Copy full SHA for 1e73b3b

Commits on Sep 18, 2023

• Wording update to no rate limiting on email triggering form

  RRudder

  committed
  b5f2757

  Copy full SHA for b5f2757

Commits on Dec 12, 2023

• Fixed file names in this folder

  Show description for 5529206
  RRudder

  committed
  5529206

  Copy full SHA for 5529206

Commits on May 15, 2024

• Merge pull request #523 from bugcrowd/Fix-folder-names

  Show description for ae4e32f
  RRudder

  authored
  ae4e32f

  Copy full SHA for ae4e32f

• Merge pull request #502 from bugcrowd/email-triggering-form-no-rate-limit

  Show description for 59d61d5
  RRudder

  authored
  59d61d5

  Copy full SHA for 59d61d5

• Merge pull request #483 from bugcrowd/RRudder-patch-7

  Show description for 6847a13
  RRudder

  authored
  6847a13

  Copy full SHA for 6847a13

• Merge pull request #482 from bugcrowd/RRudder-patch-6

  Show description for 9db8ca7
  RRudder

  authored
  9db8ca7

  Copy full SHA for 9db8ca7

• Merge pull request #481 from bugcrowd/RRudder-patch-5

  Show description for 6a212de
  RRudder

  authored
  6a212de

  Copy full SHA for 6a212de

• Merge pull request #480 from bugcrowd/RRudder-patch-4

  Show description for 8daa241
  RRudder

  authored
  8daa241

  Copy full SHA for 8daa241

• Merge pull request #479 from bugcrowd/Non-Sensitive-Data-Exposure

  Show description for 2bc1d76
  RRudder

  authored
  2bc1d76

  Copy full SHA for 2bc1d76

• Merge pull request #478 from bugcrowd/JSON-Hijacking

  Show description for c3cd25a
  RRudder

  authored
  c3cd25a

  Copy full SHA for c3cd25a

• Merge pull request #477 from bugcrowd/INternal-IP-address-disclosure

  Show description for 0f67a1a
  RRudder

  authored
  0f67a1a

  Copy full SHA for 0f67a1a

• Merge pull request #476 from bugcrowd/File-Paths-Hardcoded

  Show description for a571f1a
  RRudder

  authored
  a571f1a

  Copy full SHA for a571f1a

• Merge pull request #475 from bugcrowd/Oauth-Secrets

  Show description for ab3bb75
  RRudder

  authored
  ab3bb75

  Copy full SHA for ab3bb75

• Merge pull request #474 from bugcrowd/non-sensitive-token

  Show description for e1cf863
  RRudder

  authored
  e1cf863

  Copy full SHA for e1cf863

• Merge pull request #473 from bugcrowd/In-the-Background

  Show description for 7e8693d
  RRudder

  authored
  7e8693d

  Copy full SHA for 7e8693d

• Merge pull request #472 from bugcrowd/RRudder-patch-3

  Show description for 76c628b
  RRudder

  authored
  76c628b

  Copy full SHA for 76c628b

• Merge pull request #471 from bugcrowd/Trusted-3rd-Party

  Show description for 5c65646
  RRudder

  authored
  5c65646

  Copy full SHA for 5c65646

• Merge pull request #470 from bugcrowd/Disclosure-of-Known-Public-Information

  Show description for e2dadc9
  RRudder

  authored
  e2dadc9

  Copy full SHA for e2dadc9

• Merge pull request #469 from bugcrowd/Descriptive-Stack-Trace

  Show description for 6dac826
  RRudder

  authored
  6dac826

  Copy full SHA for 6dac826

• Merge branch 'master' into full-path-disclosure

  RRudder

  authored
  081f7b1

  Copy full SHA for 081f7b1

• Merge pull request #468 from bugcrowd/full-path-disclosure

  Show description for d7613f2
  RRudder

  authored
  d7613f2

  Copy full SHA for d7613f2

• Merge pull request #467 from bugcrowd/Non-Corporate-User

  Show description for 19319a4
  RRudder

  authored
  19319a4

  Copy full SHA for 19319a4

• Merge pull request #466 from bugcrowd/data-traffic-spam

  Show description for 571592c
  RRudder

  authored
  571592c

  Copy full SHA for 571592c

• Merge pull request #465 from bugcrowd/intentionally-public

  Show description for 6eab5b1
  RRudder

  authored
  6eab5b1

  Copy full SHA for 6eab5b1

• Merge pull request #464 from bugcrowd/Telnet-Enabled

  Show description for 6dcbe13
  RRudder

  authored
  6dcbe13

  Copy full SHA for 6dcbe13

• Merge pull request #463 from bugcrowd/Old-2FA-Code-is-Not-Invalidated

  Show description for 8a1d126
  RRudder

  authored
  8a1d126

  Copy full SHA for 8a1d126

• Merge pull request #462 from bugcrowd/2FA-Code-is-Not-Updated

  Show description for 2d052fc
  RRudder

  authored
  2d052fc

  Copy full SHA for 2d052fc

• Merge branch 'master' into Missing-Failsafe

  RRudder

  authored
  b6ebadb

  Copy full SHA for b6ebadb

• Merge pull request #461 from bugcrowd/Missing-Failsafe

  Show description for ac21e88
  RRudder

  authored
  ac21e88

  Copy full SHA for ac21e88

• Merge pull request #460 from bugcrowd/Allows-Disposable-Email-Addresses

  Show description for f145ca3
  RRudder

  authored
  f145ca3

  Copy full SHA for f145ca3

• Merge pull request #459 from bugcrowd/Verification-of-Contact-Method-not-Required

  Show description for 0c783c6
  RRudder

  authored
  0c783c6

  Copy full SHA for 0c783c6

• Merge pull request #422 from bugcrowd/test-branch

  Show description for b7ea2af
  RRudder

  authored
  b7ea2af

  Copy full SHA for b7ea2af

• Merge pull request #453 from bugcrowd/Weak-Password-Policy

  Show description for 2898471
  RRudder

  authored
  2898471

  Copy full SHA for 2898471

• Merge pull request #452 from bugcrowd/Screen-Caching-Enabled

  Show description for 991a113
  RRudder

  authored
  991a113

  Copy full SHA for 991a113

• Merge pull request #451 from bugcrowd/non-sensitive-app-data

  Show description for d8c31d7
  RRudder

  authored
  d8c31d7

  Copy full SHA for d8c31d7

• Merge pull request #450 from bugcrowd/Sensitive-App-Data

  Show description for d7a41aa
  RRudder

  authored
  d7a41aa

  Copy full SHA for d7a41aa

• Merge pull request #449 from bugcrowd/User-Password-Persisted-in-Memory

  Show description for f6b7cd1
  RRudder

  authored
  f6b7cd1

  Copy full SHA for f6b7cd1

• Merge pull request #448 from bugcrowd/System-Clipboard-Leak

  Show description for b93aae0
  RRudder

  authored
  b93aae0

  Copy full SHA for b93aae0

• Merge pull request #447 from bugcrowd/CSV-Injection

  Show description for 70c0c7f
  RRudder

  authored
  70c0c7f

  Copy full SHA for 70c0c7f

• Merge pull request #446 from bugcrowd/Autocomplete-Enabled

  Show description for 0a3f3df
  RRudder

  authored
  0a3f3df

  Copy full SHA for 0a3f3df

• Merge pull request #445 from bugcrowd/Autocorrect-Enabled

  Show description for 0af7768
  RRudder

  authored
  0af7768

  Copy full SHA for 0af7768

• Merge pull request #444 from bugcrowd/save-password

  Show description for 9db1964
  RRudder

  authored
  9db1964

  Copy full SHA for 9db1964

• Merge pull request #443 from bugcrowd/Plaintext-Password-Field

  Show description for 4661913
  RRudder

  authored
  4661913

  Copy full SHA for 4661913

• Merge pull request #442 from bugcrowd/TRACE-method-xss

  Show description for b76c074
  RRudder

  authored
  b76c074

  Copy full SHA for b76c074

• Merge pull request #441 from bugcrowd/cookie-base-xss

  Show description for 2fa695b
  RRudder

  authored
  2fa695b

  Copy full SHA for 2fa695b

• Merge pull request #440 from bugcrowd/flash-based-xss

  Show description for 1d2d25f
  RRudder

  authored
  1d2d25f

  Copy full SHA for 1d2d25f

• Merge pull request #439 from bugcrowd/self-reflected-xss

  Show description for f5b8ccc
  RRudder

  authored
  f5b8ccc

  Copy full SHA for f5b8ccc

• Merge pull request #438 from bugcrowd/self-stored-XSS

  Show description for 3cd8e1c
  RRudder

  authored
  3cd8e1c

  Copy full SHA for 3cd8e1c

• Merge pull request #433 from bugcrowd/long-timeout

  Show description for c6e5496
  RRudder

  authored
  c6e5496

  Copy full SHA for c6e5496

• Merge pull request #432 from bugcrowd/on-2FA-activation-change

  Show description for c086ced
  RRudder

  authored
  c086ced

  Copy full SHA for c086ced

• Merge pull request #430 from bugcrowd/concurrent-sessions-on-logout

  Show description for 019fa2f
  RRudder

  authored
  019fa2f

  Copy full SHA for 019fa2f

• Merge pull request #429 from bugcrowd/on-logout-serverside-only

  Show description for 64763b3
  RRudder

  authored
  64763b3

  Copy full SHA for 64763b3

• Merge pull request #428 from bugcrowd/On-logout-failure-to-invalidate-session

  Show description for b4f0ced
  RRudder

  authored
  b4f0ced

  Copy full SHA for b4f0ced

• Merge pull request #427 from bugcrowd/Session-Fixation-Local-Attack-Vector

  Show description for bef8236
  RRudder

  authored
  bef8236

  Copy full SHA for bef8236

• Merge pull request #426 from bugcrowd/Weak-Login-Function-Intended-Public-Access

  Show description for 8690d8b
  RRudder

  authored
  8690d8b

  Copy full SHA for 8690d8b

• Merge pull request #424 from bugcrowd/malformed-iOS-URL-Schemes

  Show description for 2ea4990
  RRudder

  authored
  2ea4990

  Copy full SHA for 2ea4990