What is it IDOR: Insecure Direct Object Reference These types of vulnerabilities arise from acces control issues. We will devote another entire chapter to those types of vulnerabilities. The term IDOR was made popular in by appearing in the OWASP top 10 but in reality it’s simply another type of Broken Access Control…

Introduction When we are hacking for BAC, we can apply some general tips, and the same goes for IDORs. These won’t be specific technical things we should be doing but they do are certainly a handy guide to follow a bit. IDORs, let’s first explain what they are before deep diving…

002.1 Pentesting methodologies What is it? When you’ve been testing for a while, you’ll start to see patterns emerge. Some testers have better quality standards than others and some will have totally different ways of testing. To make this more uniform and deliver a better end product for our customers, we can rely on a standardized…

XTRA. Intro The rat is out of the bag as they say. We all know I love main application hacking because it precludes broad scope hacking but how exactly do you go about this? First of all, I am going to refer to https://thexssrat.medium.com/setting-up-burp-suite-b0a6767d3408 This article will contain the basis for my…

Day 0: Recon Of course, any good project starts with enumeration so you have to make sure well equipped for the task at and if your tool of choice burp suite or OWASP zap, you will find you have to set up very similar things to get started. Burp suite starts with setting…

Introduction I often get asked this question and I can be very short about this, no. You don’t need burp pro. That being said, it does have some very big advantages that will make life a lot easier on you. So while you don’t need burp suite, you don’t need it…

In the second part of our mini-series, we are going to look at the types of XSS and what we can do to evade those pesky filters! In the last part, we are diving deeper into exploiting these filter evasions in different contexts. Stored vs Reflected Stored and reflected XSS are two types…

Introduction I think XSS is a wonderful type of exploit, we can do many things with it but exploiting it is not always easy. A lot of vulnerabilities are still missed every day because the wrong attack vector was used. In this article, I want to present you with a path…