Open Redirect: when a website trusts a URL too much 🔀 An Open Redirect is a vulnerability that occurs when an application redirects the user to a URL specified in a parameter (for example newurl or redirect) without validating that the destination belongs to a trusted domain. At first glance it seems harmless —after all, […]
🔍 An XSS that isn’t where you’d look for it Today I want to share a very instructive case of DOM-based cookie manipulation, a variant of XSS that doesn’t jump out at you during a first pass over the requests, because the problem isn’t in a parameter reflected directly in the HTML, but in a
🔓 Privilege escalation with Vim/Vi when running as SUDO One of the classic privilege escalation vectors on Linux appears when a user has permission to run vim or vi with sudo (for example, via an entry in /etc/sudoers like (ALL) NOPASSWD: /usr/bin/vim). Although at first glance it may seem like a harmless permission -“it can
🔐 Enumeration and Exploitation of JSON Web Tokens (JWT) JSON Web Tokens (JWT) are the most common mechanism nowadays for handling authentication and authorization in web applications. It’s an open standard (RFC 7519) that defines a compact format for transmitting signed information between client and server. The problem is that many implementations blindly trust the
🔍 Scenario Microsoft has raised the alarm about a high-volume phishing campaign that relies on a trick as simple as it is effective: hiding invisible Unicode characters inside keywords so that antispam filters can’t recognize them. What stands out about this case is that this technique, lately closely associated with prompt injection attacks against AI
🕵️ LFI: when the server reads what you want, not what it should 📂 We already understood what file inclusion vulnerabilities are and why they occur. Now it’s time for the practical step: exploiting them in different scenarios to read local files from the back-end server. A well-exploited Local File Inclusion (LFI) can leak configurations,
🔓 Reverse Shell, Bind Shell and Forward Shell: the three ways to “establish” a remote console When we achieve command execution on a machine (through an injection, a file upload, an exploit, etc.), the next step is almost always to turn that one-off access into a stable interactive console. There are three classic models for
CSS Injections (CSSI): when a simple color opens the door to XSS 🎨 CSS Injections (CSSI) are a type of web vulnerability that allows an attacker to inject malicious CSS code into a page, taking advantage of the fact that the application takes user input and dumps it directly into its stylesheet without validating or
forms #loginForms #registrationForms #privilegeEscalation Imagine an application with a form that sends a ping to some site, as the Cereal machine does. We’d intercept this request with burpsuite. We’re going to launch our localhost ip imagine it sends a payload like this obj=O%3A8%3A%22pingTest%22%3A1%3A%7Bs%3A9%3A%22ipAddress%22%3Bs%3A13%3A%22192.168.1.211%22%3B%7D&ip=192.168.1. At first this is urlencoded but if we select it and press
Scanning machines Initial scan ssh-keygen -f ‘/root/.ssh/known_hosts’ -R ‘172.17.0.3’ nmap -p- –open -sS –min-rate 5000 -vvv -n -Pn 172.16.116.200 -oG allPorts ## ligolo nmap -p- -sT -Pn -n –min-rate 500 -T3 172.16.116.200 -vvv -oG allPorts ## vulnlab nmap -p- -sS –min-rate 1000 T4 10.10.121.28 -oG allPorts nmap -p- -vvv –min-rate 1000 -oG allPorts ## UDP