CSRF - Applied Review
Cross-site request forgery allows an attacker to perform any actions that a normal user is able to. These attacks, when performed properly, can cause …
Posts
Clickjacking - Applied Review
Before we get into the content here I want to clarify that I wasn’t able to find any CTF-type examples of clickjacking, so if you know of one please …
Cross-Origin Resource Sharing - Applied Review
Cross-origin resource sharing (CORS) is a browser mechanism that allows for controlled access to resources located outside the original domain. It is …
XSS (Cross-Site Scripting) - Applied Review
This is going to be a longer post, so I am leaving out some more intuitive pieces of information like explaining impact and testing strategies because …
Devvortex - HTB
We can start with a port scan: We can add devvortex.htb to our hosts file but we don’t see much of anything interesting even after some directory …
NoSQL Injection - Applied Review
These types of attacks occur when attackers interfere with the queries that the web application sends to a NoSQL database. This could lead to …
XXE Injection | Applied Review
This vulnerability has to do with how certain web applications process XML data. If attackers are able to exploit this vulnerability, they can often …
SSRF - Applied Review
SSRF is a vulnerability that allows attackers to cause the application to make requests to an unintended location from the server that the application …
Codify - HTB
We can start with a port scan as we always do: We can add codify.htb to our hosts file and take a look: When we go to the ‘Try it now’ section, we can …
Race Conditions - Applied Review
Race conditions are relatively common and are closely related to business logic flaws. A collision occurs when multiple distinct threads try to …
File Upload - Applied Review
These vulnerabilities are often present when web applications contain file upload functionality that do not sufficiently validate things like the …
Access Control - Applied Review
Access control is how we describe the constraints that we place on an authorized user in the context of accessing resources and performing actions. …