Command Injection - More Techniques
We’ve already learned a decent amount about of introductory information about OS command injection when we were studying for the Burp Suite Certified …
Felonious Forums - HTB Web Challenge
In this challenge we are greeted with a web page: Let’s go ahead and make an account and very quickly we can observe that we are able to make and post …
Burp Suite Certified Practitioner Exam Review
To preface this post, I want to briefly describe my level of experience to help others who might take this exam better benchmark how long it might …
Prototype Pollution - Applied Review
This type of vulnerability allows attackers to add arbitrary properties to global object prototypes that can be inherited by user-defined objects. …
JWT Attacks - Applied Review
JSON web tokens (JWTs) are a standardized way to send some kind of cryptographically signed JSON data between systems. They can really contain any …
HTTP Host Header Attacks - Applied Review
HTTP host headers are mandatory request headers that specify the domain name the client is trying to access. For example, when you visit …
OAuth Vulnerabilities - Applied Review
If you’ve ever looked around the web and found a site that allows you to sign in with your social media account, chances are that the feature being …
HTTP Request Smuggling - Applied Review
HTTP request smuggling is a technique that interferes with the way a web application will process sequences of HTTP requests received from one or more …
Web Cache Vulnerabilities - Applied Review
This is a technique where we can get the target web server and its cache in order to serve a harmful HTTP response to other users. This typically …
Server-Side Template Injection - Applied Review
Server-Side Template Injection (SSTi) is when an attacker is able to inject some native template syntax into a template, which is exceed as code by …
GraphQL Vulnerabilities - Applied Review
GraphQL is a query language designed to provide efficient communication between clients and servers by having the client specify exactly what data …
Insecure Deserialization - Applied Review
As the name suggests, serialization is the process of converting complex data into a simpler format that can be send as a stream of bytes. This makes …