Application Security

Breaking Down the Basics: My Dive into Hop-by-Hop Header Exploits

Dive into the hidden risks of HTTP/1.1 hop-by-hop headers. We uncover how these can be exploited to trick web applications and detail the dangers of misconfigured caches spreading malicious content. Essential insights for bolstering web security.

Application Security

Source Code Review: Stategies

Hey folks, Now, It is time to go over the strategies I use for my code review. Source code review can indeed be daunting at times. However, if done correctly, it is pure bliss and gives you more satisfaction. Overview I will outline a few strategies that I love to

Red Teaming

Tunneling and Pivoting through cyber ether

After a Red Teamer (RT) get into a network via any vulnerability. The RT wants to access all the network accessible by the compromised host. Here, the lateral movement and expansion depends on how well the RT understands the Pivoting phase of the exploitation. Let's Hack Check for

Red Teaming

Primer on Antivirus Evasion

What is an Anti-Virus? It is like a COVID-19 vaccine for digital systems. It protects computer machines from bad/malicious intent software that tries to steal our data. How does it detect a threat? 1. Static Analysis 1. signature-based 1. compares the portion of the virus with the database of

Application Security

Secure Code Review #1: Basics (Getting Started)

When it comes to software engineering, you may often hear the phrase “Trust the process,” but when it comes to security, it’s more…

Threat Detection

Honeypot Series #1: Oh Snap! Did My Honeypot Just Get Breached?

It was a typical Saturday evening. I was sipping my coffee, scrolling through some logs on my Newly deployed Honeypot when a peculiar…

Application Security

SSRF Vulnerabilities Unveiled: Exploring the Depths and Defenses

Server Side Request Forgery (SSRF) is a server-side vulnerability found in web applications that lets an attacker abuse the server to make…

Application Security

Mastering the Mechanics of Command Injection: Unraveling the Web’s Silent Threat

Command injection is like telling someone to play a specific song on a jukebox, but instead of just picking a song, you sneakily add…

Application Security

Injecting Danger: Understanding Server-Side Template Exploits

SSTI, or server-side template injection, happens when attackers use the structure of templates to insert harmful code that is then executed…

Application Security

Decoding XML Vulnerabilities: From Basics to Exploits in XML External Entities

Vulnerabilities within XML parsing can act as the exploitation point for many systems. Combined, they can lead to severe consequences…

Application Security

Unmasking Directory Traversal: Navigating Vulnerabilities in Web Applications (Techniques +…

In web applications, inadequate input validation can lead to Directory Traversal vulnerabilities. If file operations are conducted using…

Application Security

Behind the Hack: The Mechanics of SQL Injection Attacks

Hello hackers, Welcome back to my new blog, I hope you all are well!! In this blog, we are going to discuss SQL Injection Attacks…

Application Security

Crossing Boundaries: A Deep Dive into Cross-Origin Attacks and Their Prevention

Hello Smart hackers, Welcome back to my new blog, I hope you all are well!! In this blog, we are going to discuss Cross-Origin Attacks and…

Application Security

A new way to classify and think about XSS (+ One-liner Automation for Bug Bounty + Tools)

Mindset matters

MITRE ATLAS: Safeguarding the Future of ML/AI

The rapid evolution of Machine Learning (ML) and Artificial Intelligence (AI) has transformed industries, from healthcare to finance…

Application Security

Secure Code Review (SCR) : A7 — Missing Function Level Access Control

In the vast landscape of web application vulnerabilities, Missing Function Level Access Control stands out as a significant concern. It…

Application Security

Secure Code Review (SCR) : A6 — Sensitive Data Exposure

Sensitive Data Exposure is a critical security concern that occurs when an application does not adequately protect sensitive information…

Application Security

Secure Code Review (SCR) : A5 — Security Misconfiguration

Security misconfiguration is a prevalent issue that can occur at any level of an application stack, including the network, platform, web…

Application Security

Secure Code Review (SCR) : A4 Insecure Direct Object Reference

Insecure Direct Object References (IDOR) is a common security vulnerability that occurs when a developer exposes a reference to an…

Application Security

Secure Code Review (SCR): A3 Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications. It allows attackers…

Application Security

Secure Code Review (SCR) : A2 Broken Authentication and Session Management

Secure Code Review: A2 Broken Authentication and Session Management

Application Security

Secure Code Review (SCR) : A1 Injection

Secure Code Review: A1 Injection

Application Security

Secure Code Review (SCR)— Getting started

This is going to be the first one in the series on code review. Here, we will talk about how to perform an efficient code review to find…

AI security

Understanding the Scammer’s Mindset: A Deep Dive into Cyber Fraud Psychology

In the ever-evolving digital world, cybercrimes, particularly scams, are on the rise. As a cybersecurity professional, I often grapple with…

CTF

TryHackMe — File Inclusion (Using python)

Link: https://tryhackme.com/room/fileinc