Open Redirect: when a website trusts a URL too much 🔀 An Open Redirect is a vulnerability that occurs when an application redirects the user to a URL specified in a parameter (for example newurl or redirect) without validating that the destination belongs to a trusted domain. At first glance it seems harmless —after all, […]
🔍 An XSS that isn’t where you’d look for it Today I want to share a very instructive case of DOM-based cookie manipulation, a variant of XSS that doesn’t jump out at you during a first pass over the requests, because the problem isn’t in a parameter reflected directly in the HTML, but in a
🔐 Enumeration and Exploitation of JSON Web Tokens (JWT) JSON Web Tokens (JWT) are the most common mechanism nowadays for handling authentication and authorization in web applications. It’s an open standard (RFC 7519) that defines a compact format for transmitting signed information between client and server. The problem is that many implementations blindly trust the
🕵️ LFI: when the server reads what you want, not what it should 📂 We already understood what file inclusion vulnerabilities are and why they occur. Now it’s time for the practical step: exploiting them in different scenarios to read local files from the back-end server. A well-exploited Local File Inclusion (LFI) can leak configurations,
forms #loginForms #registrationForms #privilegeEscalation Imagine an application with a form that sends a ping to some site, as the Cereal machine does. We’d intercept this request with burpsuite. We’re going to launch our localhost ip imagine it sends a payload like this obj=O%3A8%3A%22pingTest%22%3A1%3A%7Bs%3A9%3A%22ipAddress%22%3Bs%3A13%3A%22192.168.1.211%22%3B%7D&ip=192.168.1. At first this is urlencoded but if we select it and press