Cobalt Vulnerability Wiki
Cobalt Vulnerability Wiki
Categories
V2 - AuthenticationAuthentication Bypass2-Factor Authentication (2FA) BypassCAPTCHA Bypass - X-Forwarded-ForLack of Password ConfirmationLack of Verification EmailMail Bombing in the Contact FormMissing brute-force protection for two-factor authenticationNo Rate Limiting on a FormNo Rate Limiting or Captcha on Login PagePassword Cracking for Common/Weak Passwords when Password Policy is WeakUsername/Email Address EnumerationUsing Default Credentials Weak 2FA ImplementationWeak Login FunctionWeak Password PolicyWeak Registration Implementation over HTTP
V3 - Session ManagementV4 - Access ControlV5 - Validation/SanitizationV6 - CryptographyV7 - Error LoggingV8 - Data ProtectionV9 - CommunicationsV10 - Malicious CodeV11 - Business LogicV12 - Files ResourcesV13 - APIV14 - ConfigV2 - Authentication
Mail Bombing in the Contact Form
POC
1. Send a form and intercept the request with Burp
2. Send the request to intruder
3. Repeat sending the same request 20-30 times
4. Go to the mailbox and observe all of these messages are sent which can create a Denial of Service
Impact
Low
Likelihood
Medium-Low
Ready to get started?
Join some of these great clients we're proud to have helped