What is it IDOR: Insecure Direct Object Reference These types of vulnerabilities arise from acces control issues. We will devote another entire chapter to those types of vulnerabilities. The term IDOR was made popular in by appearing in the OWASP top 10 but in reality it’s simply another type of Broken Access Control…

Intro In the ever-evolving landscape of cybersecurity, few threats have made as profound an impact as Cross-Site Scripting (XSS). This pervasive and potent vulnerability has not only reshaped our understanding of web security but also necessitated a paradigm shift in defensive strategies. The advent of XSS XSS, a term that once only resonated within the…

Setting Upstream Proxy of ZAP to Burp Suite: Complementing Features for Better Security Testing Introduction When it comes to web application security testing, Burp Suite is a popular tool among security professionals. However, the free version, Burp Community Edition, has limited features compared to the paid version. This is where OWASP ZAP (Zed Attack Proxy) comes in. ZAP is a free and open-source web application…

Introduction When embarking on a bug bounty journey, it is crucial to carefully select your target and platform. Understanding the different types of targets, evaluating various platforms, and choosing the right program based on your skills and preferences can significantly impact your bug hunting success. In this article, we will discuss…

If you are a programmer who wants to get into the exciting and lucrative field of bug bounties, you might be wondering where to start and what skills you need to succeed. Bug bounties are rewards offered by companies or organizations for finding and reporting security vulnerabilities in their systems…

Burp Suite is a powerful tool for web application security testing. It allows you to intercept, modify, and analyze HTTP requests and responses, as well as perform various attacks and scans on web applications. However, Burp Suite can be even more powerful with the help of extensions that add new…

Introduction The cybersecurity landscape is constantly evolving and becoming more complex. As a result, professionals who want to pursue a career in this field need to acquire relevant skills and knowledge to protect and defend systems and networks from cyberattacks. One way to demonstrate your competence and credibility is to obtain…

If you are interested in becoming a professional penetration tester, you may have heard of the OffSec Certified Professional (OSCP) certification. The OSCP is one of the most respected and sought-after certifications in the cybersecurity industry, as it demonstrates your ability to perform real-world attacks and penetration tests on live…

The Open Web Application Security Project (OWASP) is a global community of security professionals who aim to improve the security of web applications and APIs. One of their most popular projects is the OWASP API top 10, which is a list of the most common and critical security risks for…