Application Security

A collection of 30 posts

Application Security

Breaking Down the Basics: My Dive into Hop-by-Hop Header Exploits

Dive into the hidden risks of HTTP/1.1 hop-by-hop headers. We uncover how these can be exploited to trick web applications and detail the dangers of misconfigured caches spreading malicious content. Essential insights for bolstering web security.

Application Security

Source Code Review: Stategies

Hey folks, Now, It is time to go over the strategies I use for my code review. Source code review can indeed be daunting at times. However, if done correctly, it is pure bliss and gives you more satisfaction. Overview I will outline a few strategies that I love to

Application Security

Secure Code Review #1: Basics (Getting Started)

When it comes to software engineering, you may often hear the phrase “Trust the process,” but when it comes to security, it’s more…

Application Security

SSRF Vulnerabilities Unveiled: Exploring the Depths and Defenses

Server Side Request Forgery (SSRF) is a server-side vulnerability found in web applications that lets an attacker abuse the server to make…

Application Security

Mastering the Mechanics of Command Injection: Unraveling the Web’s Silent Threat

Command injection is like telling someone to play a specific song on a jukebox, but instead of just picking a song, you sneakily add…

Application Security

Injecting Danger: Understanding Server-Side Template Exploits

SSTI, or server-side template injection, happens when attackers use the structure of templates to insert harmful code that is then executed…

Application Security

Decoding XML Vulnerabilities: From Basics to Exploits in XML External Entities

Vulnerabilities within XML parsing can act as the exploitation point for many systems. Combined, they can lead to severe consequences…

Application Security

Unmasking Directory Traversal: Navigating Vulnerabilities in Web Applications (Techniques +…

In web applications, inadequate input validation can lead to Directory Traversal vulnerabilities. If file operations are conducted using…

Application Security

Behind the Hack: The Mechanics of SQL Injection Attacks

Hello hackers, Welcome back to my new blog, I hope you all are well!! In this blog, we are going to discuss SQL Injection Attacks…

Application Security

Crossing Boundaries: A Deep Dive into Cross-Origin Attacks and Their Prevention

Hello Smart hackers, Welcome back to my new blog, I hope you all are well!! In this blog, we are going to discuss Cross-Origin Attacks and…

Application Security

A new way to classify and think about XSS (+ One-liner Automation for Bug Bounty + Tools)

Mindset matters

Application Security

Secure Code Review (SCR) : A7 — Missing Function Level Access Control

In the vast landscape of web application vulnerabilities, Missing Function Level Access Control stands out as a significant concern. It…

Application Security

Secure Code Review (SCR) : A6 — Sensitive Data Exposure

Sensitive Data Exposure is a critical security concern that occurs when an application does not adequately protect sensitive information…

Application Security

Secure Code Review (SCR) : A5 — Security Misconfiguration

Security misconfiguration is a prevalent issue that can occur at any level of an application stack, including the network, platform, web…

Application Security

Secure Code Review (SCR) : A4 Insecure Direct Object Reference

Insecure Direct Object References (IDOR) is a common security vulnerability that occurs when a developer exposes a reference to an…

Application Security

Secure Code Review (SCR): A3 Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications. It allows attackers…

Application Security

Secure Code Review (SCR) : A2 Broken Authentication and Session Management

Secure Code Review: A2 Broken Authentication and Session Management

Application Security

Secure Code Review (SCR) : A1 Injection

Secure Code Review: A1 Injection

Application Security

Secure Code Review (SCR)— Getting started

This is going to be the first one in the series on code review. Here, we will talk about how to perform an efficient code review to find…

Application Security

Hacking into United Nations: How I Exposed a Leaky Google Maps API Key and Entered the Hall of Fame

Introduction

Application Security

Authenticated Arbitrary File Upload leading to RCE on Poultry Farm Management System 1.0

Poultry Farm Management System 1.0 allows an authenticated user to upload a PHP file via /Redcock-Farm/farm/product.php. Exploiting this…

Application Security

CSRF on Poultry Farm Management System 1.0

Poultry Farm Management System 1.0 suffers from CSRF attack via /Redcock-Farm/farm/userregister.php. Exploiting this issue allows an…

Application Security

How I found CVE-2022–40088

Hey Squad,

Application Security

✪ All about JWT attacks (tools included) !!!

JWT is a token system that was originally created to make it possible to verify authorization. Although this may be used for…

Application Security

How I found `CVE-2022–40087`

Simple College Website 1.0 was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution.