What is it IDOR: Insecure Direct Object Reference These types of vulnerabilities arise from acces control issues. We will devote another entire chapter to those types of vulnerabilities. The term IDOR was made popular in by appearing in the OWASP top 10 but in reality it’s simply another type of Broken Access Control…

XTRA. Intro The rat is out of the bag as they say. We all know I love main application hacking because it precludes broad scope hacking but how exactly do you go about this? First of all, I am going to refer to https://thexssrat.medium.com/setting-up-burp-suite-b0a6767d3408 This article will contain the basis for my…

Day 0: Recon Of course, any good project starts with enumeration so you have to make sure well equipped for the task at and if your tool of choice burp suite or OWASP zap, you will find you have to set up very similar things to get started. Burp suite starts with setting…

Introduction I often get asked this question and I can be very short about this, no. You don’t need burp pro. That being said, it does have some very big advantages that will make life a lot easier on you. So while you don’t need burp suite, you don’t need it…

In the second part of our mini-series, we are going to look at the types of XSS and what we can do to evade those pesky filters! In the last part, we are diving deeper into exploiting these filter evasions in different contexts. Stored vs Reflected Stored and reflected XSS are two types…

Introduction I think XSS is a wonderful type of exploit, we can do many things with it but exploiting it is not always easy. A lot of vulnerabilities are still missed every day because the wrong attack vector was used. In this article, I want to present you with a path…

Password reset link not expiring After a user has used a password reset token, that token should be burned and should not be used for that account again. The problem is that sometimes developers forget to invalidate these tokens. This would allow several attack avenues such as the attacked being able to generate an…

Introduction The pentesting report is arguably one of the most important documents that come from a pentest. Do not be afraid to spend a significant amount of time to make this document shine and make sure that you use templates. …