Exhastive list of series I have watched

Sci Fi

1. Battlestar Galactica - the concept of cylons doing projections was awesome.
2. Stargate Atlantis - replicators are badass
3. Firefly (MW)
4. Legends of tomorrow  - love the concept of time masters and time pirates
5. The last ship (MW)
6. Expanse
7. Lost -(LIM)
8. Cosmos : A spacetime odyssey (MW)
9. Game of thrones
10. The 100

Others

1. Prison Break
2. House
3. Daredevil
4. Suits - (LIM)
5. Dexter
6. Homeland
7. House of Cards
8. 24
9. Six Feet Under
10. Arrow - (LIM)
11. Flash - (LIM)
12. Sopranos
13. Breaking Bad

Sitcoms
1. Modern Family
2. IT crowd

So basically I spend or waste a lot of time watching series, If you know some awesome sci-fi, post apocalyptic or awesome series do let me know.

MW - Must Watch
LIM - Left in middle, got bored or the series got too much emotion I couldnt handle.

OWASP TOP 10 IDOR: Bug Bounty romit.io

IDOR (Insecure Direct Object Reference)

Insecure Direct Object Reference is a common bug in web applications. It has without fail made to the OWASP - Top 10 vulnerabilites every time. The vulnerability exists when the application fails to verify if the user is properly authorized to access a certain endpoint/resource.

Romit has an open bug bounty program on hackerone.

Issue : 
Romit has Operator Wallets, only Owner has the permission to SHARE or UNSHARE the wallet with any user, but the application did not properly validates when someone tries to UNSHARE a wallet.

POC:

1. Suppose a wallet BITCOINS is created by user A and shared with user B and C.
2. Althoug only UserA should be able to delete shares. User B can send the following request and delete User C as there are no server side verifications

   POST /dashboard/account/<accountId>/sharing/delete HTTP/1.1
   Host: wallet.romit.io
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:37.0) Gecko/20100101 Firefox/37.0
   Accept: /
   Accept-Language: en-US,en;q=0.5
   Accept-Encoding: gzip, deflate
   Content-Type: application/x-www-form-urlencoded; charset=UTF-8
   X-Requested-With: XMLHttpRequest
   Referer: https://wallet.romit.io/dashboard
   Content-Length: 90
   Cookie:
   Connection: keep-alive
   Pragma: no-cache
   Cache-Control: no-cache

Solution:
The solution to such attacks is very simple, the application should verify that the user deleting the share is actually admin of that wallet.

Bug Bounty:
Aug 1st : Reported
Sep 1st: Acknowleged
Sep 10th: Bounty awarded 250 USD

IDORs are simple to find vulnerabilites, whenver I start testing a webapp IDOR attacks are the first ones I look out for. These simple attacks can have varied impact depending on the vulnerable endpoint.

Read about IDOR on insider.in which compromised details of every single user (including email, card number, transaction id). Yes the impact can be critical.

Here is the link to a simple IDOR on facebook, that got $12,500 bounty award as the impact of the vulnerability was high.

HTTP STS policy & using it in express

Inroduction
HSTS is a web security policy that tells the browser to access a particular website over HTTPS and can be used to prevent protocol downgrade attack & cookie hijacking. It is somewhat well supported by majority of browsers. It is communicated by the server to the client(browser) via HTTP response header field "Strict-Transport-Security" and follows the following syntax

strict-transport-security:max-age=expireTime [;includeSubdomains][;preload]

The header tells the browser to visit the site using HTTPS for the time specified in "expireTime"

The expireTime is in seconds. So max-age=15552000 tells the browser to visit a site only on HTTPS for the next six months. The other two optional parameter are

1. includeSubdomains : so if the header is set on doiloud.in , supported browsers will use HTTPS on blog.doitloud.in as well or any other subdomain for that matter.
2. preload : Since HSTS header is TOFU(trust on  first use) the very first request might have been tampered with by the attacker, so major browsers maintain a "STS preload list" that is shipped with the browser so that webiste uses HTTPS for the initial request. 

strict-transport-security header in response from the server

What if your site is loaded over HTTP? 

IF  you website is loaded over HTTP the Strict-Transport-Security header is ignored by the browser this is because an attacker might have intercepted the response and injected/removed the header. It is only when site is accessed over HTTPS with no certificate errors, the browser honors the header.


Configuring HSTS header in express 

So you can configure security headers in express using the helmet middleware which in turn is a collection of 10 small middlewares functions that can be used to setup various security headers.. This simple gist tells you how to configure helmet in express. The HSTS policy states that max-age should be defined in seconds, helmet accepts the value in milliseconds and rounds it off to the nearest second.

Limitations

1. As mentioned before this only works if your website actually has HTTPS. A user accessing your website over HTTP won't be told to switch to HTTPS, it just tells HTTPS user to stick around.