Latest Posts

• Exploiting XXE via image file upload
  November 22, 2024
• Exploiting XInclude to retrieve files
  November 22, 2024
• Exploiting XXE to perform SSRF attacks
  November 21, 2024
• Exploiting XXE using external entities to retrieve files
  November 21, 2024
• DOM-based cookie manipulation
  November 19, 2024
• DOM-based open redirection
  November 19, 2024
• DOM XSS using web messages and JSON.parse
  November 19, 2024
• DOM XSS using web messages and a JavaScript URL
  November 19, 2024
• DOM XSS using web messages
  November 19, 2024
• Exploiting a mass assignment vulnerability
  November 11, 2024
• Exploiting server-side parameter pollution in a query string
  November 11, 2024
• Finding and exploiting an unused API endpoint
  November 5, 2024
• Exploiting an API endpoint using documentation
  November 4, 2024
• Web shell upload via Content-Type restriction bypass
  November 2, 2024
• Remote code execution via polyglot web shell upload
  November 2, 2024
• Web shell upload via obfuscated file extension
  October 29, 2024
• Web shell upload via extension blacklist bypass
  October 29, 2024
• Web shell upload via path traversal
  October 28, 2024
• Remote code execution via web shell upload
  October 28, 2024
• Password reset poisoning via middleware
  October 24, 2024
• Password reset poisoning via middleware
  October 24, 2024
• Offline password cracking
  October 23, 2024
• Brute-forcing a stay-logged-in cookie
  October 23, 2024
• 2FA broken logic
  October 18, 2024
• Username enumeration via account lock
  October 18, 2024
• Broken brute-force protection, IP block
  October 18, 2024
• Password reset broken logic
  October 18, 2024
• Username enumeration via response timing
  October 18, 2024
• Username enumeration via subtly different responses
  October 17, 2024
• 2FA Bypass
  October 17, 2024
• Username enumeration via different responses
  October 17, 2024
• SSRF with filter bypass via open redirection vulnerability
  October 16, 2024
• SSRF with blacklist-based input filters
  October 16, 2024
• Blind SSRF with out-of-band detection
  October 16, 2024
• Basic SSRF against the local server
  October 16, 2024
• Basic SSRF against another back-end system
  October 16, 2024
• CORS vulnerability with trusted null origin
  October 16, 2024
• CORS vulnerability with trusted insecure protocols
  October 16, 2024
• CORS vulnerability with basic origin reflection
  October 16, 2024
• User ID controlled by request parameter with password disclosure
  October 15, 2024
• User ID controlled by request parameter with data leakage in redirect
  October 15, 2024
• URL-based access control can be circumvented
  October 15, 2024
• Unprotected admin functionality
  October 15, 2024
• Unprotected admin functionality with unpredictable URL
  October 15, 2024
• Referer-based access control
  October 15, 2024
• Multi-step process with no access control on one step
  October 15, 2024
• Method-based access control can be circumvented
  October 15, 2024
• User role controlled by request parameter
  October 15, 2024
• User role can be modified in user profile
  October 15, 2024
• User ID controlled by request parameter
  October 15, 2024
• User ID controlled by request parameter with unpredictable user IDs
  October 15, 2024
• Insecure direct object references
  October 15, 2024
• Blind OS command injection with out-of-band data exfiltration
  October 15, 2024
• Blind OS command injection with out-of-band interaction
  October 15, 2024
• Blind OS command injection with output redirection
  October 14, 2024
• Blind OS command injection with time delays
  October 14, 2024
• OS command injection, simple case
  October 14, 2024
• Source code disclosure via backup files
  October 14, 2024
• Information disclosure on debug page
  October 14, 2024
• Information disclosure in version control history
  October 14, 2024
• Information disclosure in error messages
  October 14, 2024
• Authentication bypass via information disclosure
  October 14, 2024
• CSRF vulnerability with no defenses
  October 13, 2024
• File path traversal, validation of start of path
  October 13, 2024
• File path traversal, validation of file extension with null byte bypass
  October 13, 2024
• File path traversal, traversal sequences stripped with superfluous URL-decode
  October 13, 2024
• File path traversal, traversal sequences stripped non-recursively
  October 13, 2024
• File path traversal, traversal sequences blocked with absolute path bypass
  October 13, 2024
• File path traversal, simple case
  October 13, 2024
• SameSite Strict bypass via sibling domain
  October 13, 2024
• SameSite Strict bypass via client-side redirect
  October 6, 2024
• CSRF where token is tied to non-session cookie
  October 6, 2024
• CSRF with broken Referer validation
  October 4, 2024
• CSRF where Referer validation depends on header being present
  October 3, 2024
• SameSite Lax bypass via cookie refresh
  October 3, 2024
• SameSite Lax bypass via method override
  October 3, 2024
• CSRF where token is duplicated in cookie
  October 2, 2024
• CSRF where token is not tied to user session
  October 1, 2024
• CSRF where token validation depends on token being present
  October 1, 2024
• CSRF where token validation depends on request method
  October 1, 2024
• Reflected XSS with Some SVG markup Allowed
  September 30, 2024
• Reflected XSS into a template literal with angle brackets, single, double quotes
  September 30, 2024
• Stored XSS into onclick event with angle brackets and double quotes HTML-encoded
  September 30, 2024
• Reflected XSS into a JavaScript string with Angle Brackets and HTML encoded
  September 30, 2024
• Reflected XSS into a JavaScript string with single quote and backslash escaped
  September 30, 2024
• Reflected XSS in canonical link tag
  September 30, 2024
• Reflected XSS into HTML context with most tags and attributes blocked
  September 29, 2024
• Exploiting XSS to perform CSRF
  September 29, 2024
• Exploiting cross-site scripting to capture passwords
  September 29, 2024
• Exploiting cross-site scripting to steal cookies
  September 29, 2024
• Stored DOM XSS
  September 28, 2024
• Reflected DOM XSS
  September 28, 2024
• DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded
  September 28, 2024
• DOM Based XSS in document.write sink using source location.search inside a select element
  September 28, 2024
• SQL injection with filter bypass via XML encoding
  September 28, 2024
• Blind SQL injection with out-of-band data exfiltration
  September 26, 2024
• Blind SQL injection with out-of-band interaction
  September 26, 2024
• Blind SQL injection with time delays and information retrieval
  September 25, 2024
• Blind SQL injection with time delays
  September 23, 2024
• Blind SQL injection with conditional errors
  September 22, 2024
• Blind SQL injection with conditional responses
  September 22, 2024
• SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
  September 19, 2024
• SQL injection vulnerability allowing login bypass
  September 19, 2024
• SQL injection attack, listing the database contents on Oracle
  September 18, 2024
• SQL injection attack, listing the database contents on non-Oracle databases
  September 17, 2024
• SQL injection UNION attack, retrieving multiple values in a single column
  September 8, 2024
• SQL injection UNION attack, retrieving data from other tables
  September 8, 2024
• SQL injection UNION attack, retrieving data from other tables
  September 7, 2024
• SQL injection UNION attack, determining the number of columns returned by the query
  September 7, 2024
• SQL injection attack, querying the database type and version on Oracle
  September 6, 2024
• SQL injection attack, querying the database type and version on MySQL and Microsoft
  September 6, 2024
• Pillage Exposed RDS Instances
  June 27, 2024
• Plunder Public RDS Snaphots
  June 25, 2024
• Leverage Leaked Credentials For Pwnage
  June 24, 2024
• Gandalf Lakera AI - Prompt Injection Challenge
  June 7, 2024
• Sau - HTB Walkthrough
  June 1, 2024
• Exploit SSRF with Gopher for GCP Initial Access
  May 26, 2024
• Reveal Hidden Files in Google Storage
  May 26, 2024
• Loot Public EBS Snapshots
  May 3, 2024
• Analytics - HTB Walkthrough
  March 23, 2024
• Cozyhosting - HTB Walkthrough
  March 2, 2024
• Breach In the Cloud - AWS Cloudtrial Challenge
  March 2, 2024
• Keeper - HTB Walkthrough
  February 10, 2024
• Hunt for Secrets in Github Repositories
  January 7, 2024
• Identify Account ID from a Public s3 Bucket
  October 27, 2023
• Leaked Database and SMTP credentials through .env file
  October 9, 2023
• RCE on Application’s Tracking Admin Panel
  September 3, 2023
• Big IAM Challenge - Wiz CTF Challenge
  July 11, 2023
• A Tale of Weird XSS into $100
  October 11, 2021
• A story of Default wordlist in Dirsearch to 20k INR Bounty
  October 6, 2021
• OverTheWire: Bandit Walkthrough (Levels 14-34)
  February 2, 2020
• OverTheWire: Bandit Walkthrough (Levels 0-14)
  February 1, 2020