hacktricks/network-services-pentesting/pentesting-web/jira.md

<details>

<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Ander maniere om HackTricks te ondersteun:

* As jy jou **maatskappy geadverteer wil sien in HackTricks** of **HackTricks in PDF wil aflaai**, kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Sluit aan by die** 💬 [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Deel jou hacking-truuks deur PRs in te dien by die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github-opslag.

</details>


## Kontroleer Voorregte

In Jira kan **voorregte gekontroleer word** deur enige gebruiker, geïdentifiseer of nie, deur die eindpunte `/rest/api/2/mypermissions` of `/rest/api/3/mypermissions`. Hierdie eindpunte onthul die gebruiker se huidige voorregte. 'n Belangrike bekommernis ontstaan wanneer **nie-geïdentifiseerde gebruikers voorregte het**, wat dui op 'n **sekuriteitskwesbaarheid** wat moontlik in aanmerking kan kom vir 'n **beloning**. Soortgelyk dui **onverwagte voorregte vir geïdentifiseerde gebruikers** ook op 'n **kwesbaarheid**.

'n Belangrike **opdatering** is op **1 Februarie 2019** gemaak, wat vereis dat die 'mypermissions' eindpunt 'n **'permission'-parameter** insluit. Hierdie vereiste is bedoel om die sekuriteit te **verbeter** deur die voorregte wat ondervra word, te spesifiseer: [kyk dit hier](https://developer.atlassian.com/cloud/jira/platform/change-notice-get-my-permissions-requires-permissions-query-parameter/#change-notice---get-my-permissions-resource-will-require-a-permissions-query-parameter)

- ADD_COMMENTS
- ADMINISTER
- ADMINISTER_PROJECTS
- ASSIGNABLE_USER
- ASSIGN_ISSUES
- BROWSE_PROJECTS
- BULK_CHANGE
- CLOSE_ISSUES
- CREATE_ATTACHMENTS
- CREATE_ISSUES
- CREATE_PROJECT
- CREATE_SHARED_OBJECTS
- DELETE_ALL_ATTACHMENTS
- DELETE_ALL_COMMENTS
- DELETE_ALL_WORKLOGS
- DELETE_ISSUES
- DELETE_OWN_ATTACHMENTS
- DELETE_OWN_COMMENTS
- DELETE_OWN_WORKLOGS
- EDIT_ALL_COMMENTS
- EDIT_ALL_WORKLOGS
- EDIT_ISSUES
- EDIT_OWN_COMMENTS
- EDIT_OWN_WORKLOGS
- LINK_ISSUES
- MANAGE_GROUP_FILTER_SUBSCRIPTIONS
- MANAGE_SPRINTS_PERMISSION
- MANAGE_WATCHERS
- MODIFY_REPORTER
- MOVE_ISSUES
- RESOLVE_ISSUES
- SCHEDULE_ISSUES
- SET_ISSUE_SECURITY
- SYSTEM_ADMIN
- TRANSITION_ISSUES
- USER_PICKER
- VIEW_AGGREGATED_DATA
- VIEW_DEV_TOOLS
- VIEW_READONLY_WORKFLOW
- VIEW_VOTERS_AND_WATCHERS
- WORK_ON_ISSUES

Voorbeeld: `https://jou-domein.atlassian.net/rest/api/2/mypermissions?permissions=BROWSE_PROJECTS,CREATE_ISSUES,ADMINISTER_PROJECTS`
```bash
#Check non-authenticated privileges
curl https://jira.some.example.com/rest/api/2/mypermissions | jq | grep -iB6 '"havePermission": true'
```
## Outomatiese opname

* [https://github.com/0x48piraj/Jiraffe](https://github.com/0x48piraj/Jiraffe)
* [https://github.com/bcoles/jira\_scan](https://github.com/bcoles/jira\_scan)


<details>

<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Ander maniere om HackTricks te ondersteun:

* As jy jou **maatskappy geadverteer wil sien in HackTricks** of **HackTricks in PDF wil aflaai**, kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Sluit aan by die** 💬 [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Deel jou haktruuks deur PR's in te dien by die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github-repos.

</details>