osTicket

osTicket exploitation

HTB: Delivery0xdf hacks stuff

Footprinting/Discovery/Enumeration

OSTSESSID cookie

Vulnerabilities

osTicket version 1.14.1 suffers from CVE-2020-24881 which was an SSRF vulnerability.

If we come across a customer support portal during our assessment and can submit a new ticket, we may be able to obtain a valid company email address.

If the company set up their helpdesk software to correlate ticket numbers with emails, then any email sent to the email we received when registering, [e-mail], would show up here. With this setup, if we can find an external portal such as a Wiki, chat service (Slack, Mattermost, Rocket.chat), or a Git repository such as GitLab or Bitbucket, we may be able to use this email to register an account and the help desk support portal to receive a sign-up confirmation email.

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

• The Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more

• Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them

• Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.