Gabe Roy

Introduction # I initially made a blog post called ‘Understanding Kerberoasting’ that I since removed because I feel it didn’t quite go into enough detail and cover everything I wanted it to.

Introduction # We have talked about CSRF and XSS before, but here we will focus on exploits in modern web applications that typically require the writing of custom payloads for accomplishing specific tasks. We also want to walk through the common security measures in web applications like Same-Origin Policy, Cross-Origin Resource Sharing, SameSite Cookies, and so on. The reason CSRF and XSS are often paired together in this context is because forging a request on another user’s behalf often involves multiple steps other than just clicking on a link, stored XSS (or in some cases reflected XSS) can be used to deliver a CSRF payload to a victim.

I am again making an applied review blog post series (and maybe video series) for the modules used to prepare for the CWEE exam. Each one will go over one of the modules from HTB Academy, then include some examples from vulnerable machines and CTF challenges.