One Misplaced Header, Thousands of Leaked Sessions: A Bug Bounty Story
文章描述了一个安全漏洞:通过常规侦察手段发现应用在处理会话缓存时存在问题,导致用户登录状态被意外继承。 2025-12-29 06:3:23 Author: infosecwriteups.com(查看原文) 阅读量:4 收藏

Iski

Free Link 🎈

Heey there!😁

Press enter or click to view image in full size

Image by AI

I refreshed the page.

I got logged in — as someone else.

I refreshed again. Still logged in.

At that point, I wasn’t debugging the app anymore… the app was debugging its own life choices.

🎯 The Calm Before the Storm: Mass Recon Done Right

This bug didn’t come from a lucky payload. It came from boring, repeatable recon — the kind most people skip.

My routine:

  • Historical URL scraping (Wayback, GAU)
  • Header diffing across environments
  • CDN behavior analysis using response headers
  • Mapping authenticated vs unauthenticated cache behavior

One response stood out like a red flag in a green dashboard:

X-Cache: HIT
Set-Cookie: session=abc123; Secure; HttpOnly

文章来源: https://infosecwriteups.com/one-misplaced-header-thousands-of-leaked-sessions-a-bug-bounty-story-9cc0ee4b3e38?source=rss----7b722bfd1b8d---4
如有侵权请联系:admin#unsafe.sh