# JIRA
从零开始学习AWS黑客技术，成为专家htARTE（HackTricks AWS Red Team Expert）！
支持HackTricks的其他方式：
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
如果您对**黑客职业**感兴趣并想要攻破不可攻破的 - **我们正在招聘！**（需要流利的波兰语书面和口语表达能力）。
{% embed url="" %}
### 检查权限
在Jira中，**权限可以通过**端点`/rest/api/2/mypermissions`或`/rest/api/3/mypermissions`由任何用户（已认证或未认证）进行检查。这些端点会显示用户当前的权限。当**未经身份验证的用户拥有权限**时，可能会出现一个**安全漏洞**，有可能符合**悬赏**的条件。同样，对于已认证用户的**意外权限**也突显了一个**漏洞**。
在**2019年2月1日**进行了一项重要的**更新**，要求'mypermissions'端点包括一个\*\*'permission'参数\*\*。此要求旨在通过指定正在查询的权限来**增强安全性**：[点击此处查看](https://developer.atlassian.com/cloud/jira/platform/change-notice-get-my-permissions-requires-permissions-query-parameter/#change-notice---get-my-permissions-resource-will-require-a-permissions-query-parameter)
* ADD\_COMMENTS
* ADMINISTER
* ADMINISTER\_PROJECTS
* ASSIGNABLE\_USER
* ASSIGN\_ISSUES
* BROWSE\_PROJECTS
* BULK\_CHANGE
* CLOSE\_ISSUES
* CREATE\_ATTACHMENTS
* CREATE\_ISSUES
* CREATE\_PROJECT
* CREATE\_SHARED\_OBJECTS
* DELETE\_ALL\_ATTACHMENTS
* DELETE\_ALL\_COMMENTS
* DELETE\_ALL\_WORKLOGS
* DELETE\_ISSUES
* DELETE\_OWN\_ATTACHMENTS
* DELETE\_OWN\_COMMENTS
* DELETE\_OWN\_WORKLOGS
* EDIT\_ALL\_COMMENTS
* EDIT\_ALL\_WORKLOGS
* EDIT\_ISSUES
* EDIT\_OWN\_COMMENTS
* EDIT\_OWN\_WORKLOGS
* LINK\_ISSUES
* MANAGE\_GROUP\_FILTER\_SUBSCRIPTIONS
* MANAGE\_SPRINTS\_PERMISSION
* MANAGE\_WATCHERS
* MODIFY\_REPORTER
* MOVE\_ISSUES
* RESOLVE\_ISSUES
* SCHEDULE\_ISSUES
* SET\_ISSUE\_SECURITY
* SYSTEM\_ADMIN
* TRANSITION\_ISSUES
* USER\_PICKER
* VIEW\_AGGREGATED\_DATA
* VIEW\_DEV\_TOOLS
* VIEW\_READONLY\_WORKFLOW
* VIEW\_VOTERS\_AND\_WATCHERS
* WORK\_ON\_ISSUES
示例：`https://your-domain.atlassian.net/rest/api/2/mypermissions?permissions=BROWSE_PROJECTS,CREATE_ISSUES,ADMINISTER_PROJECTS`
```bash
#Check non-authenticated privileges
curl https://jira.some.example.com/rest/api/2/mypermissions | jq | grep -iB6 '"havePermission": true'
```
### 自动枚举
*
*
如果您对**黑客职业**感兴趣并想要攻破不可攻破的系统 - **我们正在招聘！**（需要流利的波兰语书面和口语能力）。
{% embed url="" %}
从零开始学习AWS黑客技术，成为专家htARTE（HackTricks AWS Red Team Expert）！
支持HackTricks的其他方式：
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**上关注**我们。
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://hacktricks.xsx.tw/network-services-pentesting/pentesting-web/jira.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.