Nuclei is an open-source framework designed for automating the detection and exploitation of vulnerabilities in web applications and other network services. It allows penetration testers and security researchers to define custom templates that specify a set of HTTP requests to send to a target, along with corresponding matching rules…

Hello everyone, in this article I’m going to share with you how I found Blind OS Command Injection vulnerability via account activation request. Firstly, what is blind os command injection? OS Command Injection is a web security vulnerability that allows an attacker to execute operating system (OS) command to the…

Welcome back hackers, and let’s jump right into part 2 of our SSRF exploitation adventure. Summary: Through the effective exploitation of the SSRF vulnerability, Was able to bypass security protocols and utilize an iFrame to load “localhost” within a PDF file. ##Let’s pick up where we left off. Despite initial…

Introduction This article will explain the tools and techniques used by web application penetration testers and security researchers to successfully bypass web application firewall (WAF) protections. WAFs are a cybersecurity solution to filter and block malicious web traffic. Common vendors include CloudFlare, AWS, Citrix, Akamai, Radware, Microsoft Azure, and Barracuda. Depending…

Overview Auditing the security configuration of GraphQL API can be a complex task, as it involves protecting against a wide range of vulnerabilities. The following article will cover some common security flaws in GraphQL APIs. Injection attacks: GraphQL APIs are vulnerable to injection attacks, just like any other API. To prevent…

ChatGPT and AI have been experiencing their best days for several months. We can find their usage in truth everywhere. This has not escaped the security industry either. In this article, we will look at how to talk to ChatGPT to create exploits for us, and we will try to…

Most of the time if you find open redirection on login functionality there are chances to escalate it to RXSS. Hello Folks, In this article, I will explain how to escalate open redirection into RXSS. What is Open Redirection? If an application has a vulnerable redirection parameter, the attacker will…

I already explained in my previous article → IDOR is everywhere. IDOR is easy to exploit and doesn’t require much effort to find. Hello Folks, In this article, I would like to explain the IDOR on my own university application. Let’s get Started !! 😉 I’m studying for my Post…

Sometimes simple payloads help to bypass the WAF filter. Hello Folks, in this article let’s see how I executed the XSS on Cloudflare WAF Protected web app. Let’s get Started !! 😉 This is one of my old targets, If I want to spend some time on pen-testing, I usually…