osTicket

attacking_common_applications

osticket is an open-source ticketing system. It is written in PHP and uses a MySQL database as the backend.

📚 You can identify osTicket from the OSTSESSID cookie.

As a pentester, compromising a ticketing platform is often handy.

  • 🔑 We may gain access to valid emails, either to access company-only platforms or perform social attacks

  • 💵 We may gain access to sensitive information

  • 🔫 We may find usernames for other attacks

  • 🔏 We may be able to create users