Content Spoofing On *.line.me
What Is Content Spoofing ? Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user. This presents the user with a modified page under the context of the trusted domain. This attack is typically used as, or in conjunction with, social engineering because the attack is exploiting a code-based vulnerability and a user's trust. PoC Vuln URL : http://partner-points.line.me/%2f../free%20sticker%20has%20been%20changed%20by%20a%20new%20one%20https://www.evil.com%20so%20go%20to%20the%20new%20one%20since%20this%20one Reference https://www.owasp.org/index.php/Content_Spoofing https://hackerone.com/reports/181594 https://hackerone.com/reports/154921 Respond Line :...
