Merge pull request KathanP19#221 from v3daxt/master

Added new methods & Bypasses

Account_Takeovers_Methodologies/Account_Takeovers_Methods.md

@@ -28,6 +28,14 @@ So if you find that target have weak password policy, try to go for no rate limi
 ## Using  Auth Bypass
 ```
 Check out Auth Bypass method, there is a method for OTP bypass via response manipulation, this can leads to account takeovers.
+1.Enter the wrong auth code / Password
+2.Capture a auth request in burpsuite and send it to repeater 
+3.Check for the resoponse
+4.Change the respone by manipulating the following parameters
+  {“code”:”invalid_credentials”} -> {“code”:”valid_credentials”}
+  {“verify”:”false”}             -> {“verify”:”true”}
+  
+  
 ```
 ## Try For CSRF On
 ```
@@ -61,6 +69,8 @@ Check out Auth Bypass method, there is a method for OTP bypass via response mani
 
 ## Reference:
 * Various Source From Google,Twitter,Medium
+* https://avanishpathak.medium.com/an-account-takeover-vulnerability-due-to-response-manipulation-e23fe629bd1
 
 ## Author
 * [@Virdoex_hunter](https://twitter.com/Virdoex_hunter)
+* [@v3daxt](https://twitter.com/v3daxt)

Authentication_Bypass/OTP_Bypass.md

@@ -64,10 +64,18 @@
      4) if there is no Rate Limit then wait for 200 Status Code (Sometimes 302)
      5)if you get 200 ok or 302 Found Status Code that means you've bypass OTP
  ```
+ ## More test cases for bypassing OTP-
+ ```
+     1) Check for default OTP - 111111, 123456, 000000
+     2) Check if otp has been leaked in respone (Capture the request in burpsuite and send it to repeater to check the response)
+     3) Check if old OTP is still vaild
+ ```
+
 
 ### Contributors:
 * [@akshaykerkar13](https://twitter.com/akshaykerkar13)
 * [@Yn0tWhy](https://twitter.com/Yn0tWhy)
 * [@Virdoex_hunter](https://twitter.com/Virdoex_hunter)
 * [febinrev](https://twitter.com/febinrev)
 * [Fani Malik](https://twitter.com/fanimalikhack)
+* [@v3daxt](https://twitter.com/v3daxt)

BrokenLinkHijacking/BrokenLinkHijacking.md

@@ -13,7 +13,7 @@
  3. Now you need to check if company has the page or not , if no then register as the company or try to get that username or url. 
 
  ## Alternate Step
- 1. Go to [Online Broken Link Checker](https://ahrefs.com/broken-link-checker) Or [Alternative Online Broken Link Checker](https://brokenlinkcheck.com/)
+ 1. Go to [Online Broken Link Checker](https://ahrefs.com/broken-link-checker), [Dead Link Checker](https://www.deadlinkchecker.com/) Or [Alternative Online Broken Link Checker](https://brokenlinkcheck.com/)
  2. Input the domain name
 
 ## Reference
@@ -24,3 +24,4 @@
 ### Author:
 * [@KathanP19](https://twitter.com/KathanP19)
 * [@cyph3r_asr](https://twitter.com/cyph3r_asr)
+* [@v3daxt](https://twitter.com/v3daxt)