host-header-injection

1 article
sort: new top best
clear filter
0 5/10

Researcher bypassed 2FA on www.domain.com by intercepting the login request with Burp Suite, changing the Host header to beta.domain.com (a parallel subdomain without 2FA enforcement), and submitting an arbitrary code (000000) to successfully authenticate. The vulnerability stemmed from inconsistent 2FA implementation across subdomains, fixed within one day but without bounty payout.

Seqrity InfoSec Write-ups
infosecwriteups.com · kh4sh3i/bug-bounty-writeups · 15 hours ago · details