Just nowIDOR Vulnerabilities in Image Upload FunctionLet’s see one example, considering there are two users in an application i.e. User A and User B. User-A is having a unique profile ID of 1000 and User B is having a profile ID of 1002. In a normal scenario user A will only have access to his own…Infosec4 min readInfosec4 min read
Just nowHow to Password Protect Web Directories on NginxIn this guide, you’ll learn how to password protect a directory on your website by implementing a username/password authentication using nginx HTTP basic auth. HTTP basic authentication allows you to stop other people who don’t have the login credentials from accessing the section/folder you are protecting. Install Apache Utils To start out, you…Infosec3 min readInfosec3 min read
Just nowIntroduction to OpenVAS — A Vulnerability ScannerIntroduction Open Vulnerability Assessment System (OpenVAS) is a tool in Kali Linux for vulnerability scanning of the system on a network. OpenVAS is a framework consisting of multiple services and tools and requires Python binaries. ⚠️ Disclaimer: All information, techniques, and tools described in this write-up are for educational purposes only. Use…Infosec4 min readInfosec4 min read
Just nowUnderstanding SSTI and Building Payloads in Jinja2Imagine having the power to craft stunning dynamic web pages effortlessly. Sounds amazing, right? But hold on! With great power comes great responsibility, especially when it comes to securing your applications. Jinja2 is a widely used template engine for Python web applications. It is highly flexible and provides a powerful…Infosec4 min readInfosec4 min read
Just nowExploiting CORS misconfigurationsIn this article I will explain what Cross-Origin Resource Sharing (CORS) is and show you how attackers can exploit Cross-Origin Resource Sharing misconfigurations. Disclaimer This article is for informational and educational purpose only, and for those who’re willing and curious to know and learn about Security and Penetration Testing. The…Infosec10 min readInfosec10 min read
Just nowSimple Examples of LDAP Injection VulnerabilitiesWhat Is LDAP & How Does It Work? by Okta What is LDAP? LDAP stands for “Lightweight Directory Access Protocol.” It is a way to organise and access information about users, devices, and resources in a network or an organisation. Think of it as a digital phonebook or address book for computers and…Infosec4 min readInfosec4 min read
Just nowA Comprehensive Approach for Testing for SQL Injection VulnerabilitiesTrust me, it really feels good when you see this the below screenshot on your target application and why not? SQL injection vulnerabilities generally are a valid P1 issues on bug bounty programs. It becomes easy to find SQL Injection if we understand, How an application behaves in response to…Infosec3 min readInfosec3 min read
Just nowIntroducing NucleiFuzzer: A Powerful Automation Tool for Web Application SecurityIn today’s digital landscape, web application security is of paramount importance. With cyber threats becoming increasingly sophisticated, it is crucial for developers and security professionals to have robust tools at their disposal to detect vulnerabilities. In this article, we will explore the features and usage of my tool NucleiFuzzer, a…Infosec2 min readInfosec2 min read
Just nowBehind the Hack: The Mechanics of SQL Injection AttacksHello Smart hackers, Welcome back to my new blog, I hope you all are well!! In this blog, we are going to discuss SQL Injection Attacks. Please, read this article until the end. SQL injection arises when user input isn’t properly sanitized before being incorporated into database queries. This allows…Infosec4 min readInfosec4 min read
Just nowHacking into gRPC-WebIt started when I faced a web application using gRPC-Web and I could not manipulate the requests in Burp Suite. I searched a lot and there was no good or complete resource for pentesting gRPC-Web, then the research began and I could make a tool and a Burp Suite Extension…Infosec7 min readInfosec7 min read
