Hello, I am Virendra Pawar, founder of Sudarshana Labs, and a passionate penetration testing, bug bounty hunting, and security research, I have always been interested in pursuing certificates to up-skill myself and gain a valuable credential. After earning my OSCP, OSWE, and OSEP certifications, I found myself at a crossroads. Despite my passion for offensive security, I realized that I was not feeling to pursue OSED, primarily because of binary exploitation.

At Sudarshana Labs, we push the boundaries of cybersecurity, offering cutting-edge services to businesses seeking reliable security for their cloud environments. Sharing my personal journey in this blog goes beyond my certification; it aims to assist fellow cybersecurity enthusiasts and demonstrate how certifications like GCPN can significantly shape your cloud security expertise.

A PDF preview feature accepted HTML input and utilized Prince (PrinceXML). Prince’s JavaScript API includes PDF.attachFile(...), and calling it with a local path or an internal URL caused the generated PDF to include server’s local files as attachments. These attachments can be pulled out locally (for example with pdfdetach), turning a simple preview into a working LFI vulnerability.

This post is a writeup of one of our recent bug bounty findings, powered by Sudarshana’s ASM (Attack Surface Management) program. The goal of this blog is to share the real steps we took, what worked, what failed, and the takeaways. This should help in demonstrating capabilities of our ASM along with presenting vulnerability discovered in production environment on one of the biggest e-commerce company.

In this blog, we will take you through a real-world encounter with a patched Open Redirect vulnerability that turned out to be not-so-patched after all. The target was a modern web application with a typical redirect mechanism using a destination parameter. Such parameter names are actually demanding attention to get exploited as either a Cross-Site Scripting or Open Redirect issue. However, this endpoint appeared to be patched and now comes our game.