GitBook: [#3748] No subject

SUMMARY.md

@@ -464,6 +464,7 @@
 * [Cache Poisoning and Cache Deception](pentesting-web/cache-deception.md)
 * [Clickjacking](pentesting-web/clickjacking.md)
 * [Client Side Template Injection (CSTI)](pentesting-web/client-side-template-injection-csti.md)
+* [Client Side Path Traversal](pentesting-web/client-side-path-traversal.md)
 * [Command Injection](pentesting-web/command-injection.md)
 * [Content Security Policy (CSP) Bypass](pentesting-web/content-security-policy-csp-bypass/README.md)
   * [CSP bypass: self + 'unsafe-inline' with Iframes](pentesting-web/content-security-policy-csp-bypass/csp-bypass-self-+-unsafe-inline-with-iframes.md)

generic-methodologies-and-resources/external-recon-methodology/README.md

@@ -105,8 +105,9 @@ You can also perform some automatic reverse whois discovery with [amass](https:/
 If find the **same ID of the same tracker** in 2 different pages you can suppose that **both pages** are **managed by the same team**.\
 For example, if you see the same **Google Analytics ID** or the same **Adsense ID** on several pages.
 
-There are some pages that let you search by these trackers and more:
+There are some pages and tools that let you search by these trackers and more:
 
+* ****[**Udon**](https://github.com/dhn/udon)****
 * [**BuiltWith**](https://builtwith.com)
 * [**Sitesleuth**](https://www.sitesleuth.io)
 * [**Publicwww**](https://publicwww.com)

pentesting-web/client-side-path-traversal.md

@@ -0,0 +1,33 @@
+# Client Side Path Traversal
+
+<details>
+
+<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
+
+* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
+* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
+
+</details>
+
+## Basic Information
+
+A client side path traversal occurs when you can **manipulate the path of a URL** that is going to be **sent to a user to visit in a legit way** or that a user is somehow going to be **forced to visit for example via JS or CSS**.
+
+In [**this writeup**](https://erasec.be/blog/client-side-path-manipulation/), it was possible to **change the invite URL** so it would end up **canceling a card**.
+
+In [**this writeup**](https://mr-medi.github.io/research/2022/11/04/practical-client-side-path-traversal-attacks.html), it was possible to combine a **client side path traversal via CSS** (it was possible to change the path where a CSS resource was loaded from) with an **open redirect** to load the CSS resource from an **attacker controlled domain**.
+
+<details>
+
+<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
+
+* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
+* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
+
+</details>

pentesting-web/domain-subdomain-takeover.md

@@ -39,6 +39,7 @@ There are several tools with dictionaries to check for possible takeovers:
 * [https://github.com/Ice3man543/SubOver](https://github.com/Ice3man543/SubOver)
 * [https://github.com/m4ll0k/takeover](https://github.com/m4ll0k/takeover)
 * [https://github.com/antichown/subdomain-takeover](https://github.com/antichown/subdomain-takeover)
+* [https://github.com/musana/mx-takeover](https://github.com/musana/mx-takeover)
 
 ### Subdomain Takeover Generation via DNS Wildcard