Web Application Security

Website Defacement Picture this: you’re the head of IT in your company, earning six figures and enjoying a relaxing vacation in the Bahamas. It’s a Saturday morning, and you decide to check in on your company’s website, only to find a disturbing message left by hackers. “Hacked by Th3 R3d Star Group“…

Hey Guys, I hope you are doing well, I’m Muhammad Elgllad, Welcome to my first Writupe ♥ Summary: Ability bypass email confirmation and get into to Dashboard directly without verifying the email, Vulnerability Type: Business Logic Errors Severity: Medium Bounty: 300$ Description This is a small story about one of my…

Introduction Web security is an increasingly critical aspect of our digital lives as we rely increasingly on web applications for various tasks. Among the numerous vulnerabilities that can jeopardize user data and compromise sensitive information, Stored Cross-Site Scripting (XSS) is a significant threat. This article delves into the intricate world of…

Hi, how are you guys?, I hope you are fine. This is my first article of the month, I hope you enjoy it. All of this started when my friend wanted to learn through the website and I thought “hmm, interesting, let start this one”. First enumerated subdomains using amass and…

Introduction In this project on web app pentesting, I will be showcasing the exploitation of vulnerabilities in Damn Vulnerable Web Application (DVWA) through DOM-based Cross-Site Scripting. Cross-Site Scripting DOM, or XSS DOM, refers to a type of web vulnerability that occurs when an attacker can inject malicious scripts into a website’s…

For this project, I will showcase how ZAP is utilized to conduct penetration testing of a web application through Fuzzing. ZAP, short for Zed Attack Proxy, is an open-source web application security testing tool. It is designed to help security professionals find vulnerabilities in web applications during the development and…

WHICH IS A BETTER PHP FRAMEWORK FOR YOUR NEXT WEB APPLICATION — CODEIGNITER OR LARAVEL?

AWS WAF: Your First Line of Defence Against Web Exploits — In the digital age, the security of web applications is a paramount concern. The threat landscape expands as the world becomes increasingly interconnected, and the need for robust security measures grows. …

In this article, I share my journey of developing DeepSubh, a powerful subdomain enumeration automation script that does subdomain enumeration upto 4th level deeper. Generally we ignore deeper level subdomain enumeration while doing vapt stuffs or bug bounty. But, it is one of the important phase to find hidden endpoints…