JWT Attacks - Applied Review
JSON web tokens (JWTs) are a standardized way to send some kind of cryptographically signed JSON data between systems. They can really contain any …
Posts
HTTP Host Header Attacks - Applied Review
HTTP host headers are mandatory request headers that specify the domain name the client is trying to access. For example, when you visit …
OAuth Vulnerabilities - Applied Review
If you’ve ever looked around the web and found a site that allows you to sign in with your social media account, chances are that the feature being …
HTTP Request Smuggling - Applied Review
HTTP request smuggling is a technique that interferes with the way a web application will process sequences of HTTP requests received from one or more …
Web Cache Vulnerabilities - Applied Review
This is a technique where we can get the target web server and its cache in order to serve a harmful HTTP response to other users. This typically …
Server-Side Template Injection - Applied Review
Server-Side Template Injection (SSTi) is when an attacker is able to inject some native template syntax into a template, which is exceed as code by …
Bizness - HTB
As always, we can begin with a port scan: Let’s go ahead and add bizness.htb to our /etc/hosts file and look at the site. If we scroll to the bottom …
GraphQL Vulnerabilities - Applied Review
GraphQL is a query language designed to provide efficient communication between clients and servers by having the client specify exactly what data …
Insecure Deserialization - Applied Review
As the name suggests, serialization is the process of converting complex data into a simpler format that can be send as a stream of bytes. This makes …
DOM-Based Vulnerabilities - Applied Review
The document object model is a web browser’s representation of the elements on the page. Websites use JavaScript to manipulate nodes and objects in …
WebSockets - Applied Review
WS (WebSockets) are widely used in modern web applications because they can initiate long-lived sessions over HTTP with asynchronous communication in …
API Testing - Applied Review
Application Programming Interfaces (APIs) allow for different software systems and applications to share data. An example of this might be a weather …