C1h2e1 Dec 21, 2019·11 min read I just want to write a check list for myself. This article includes various vulnerability discovery method bypass methods. I hope you can read it carefully . Twitter @C1h2e11 Wechat : baiheming123456 RECON Most of my recon ideas come from nahamsec, he is really…

I willl collect some ideas Cre:Full Account takeover (ATO) — a tale of two bugs 🐛 | by Kwadwo Amoako | Feb, 2022 | Medium An account takeover (ATO) is when an attacker gains access to the data 2. An API base Insercure Direct Object Reference (IDOR) , which occurs…

Cre: Machevalia’s Blog -I will collect some methods RCE occurs after a file upload it is due to either A lack of filtering in the file types that can be uploaded 2.Error in that filtering process for the web form where the file is being uploaded Many web applications filter…

Cre:How I was able to find multiple vulnerabilities of a Symfony Web Framework web application | by Abid Ahmad | Jan, 2022 | Medium Hello . Today I’ll explain how I found multiple vulnerabilites on a web app that used the Symfony Web Framwork where Symfony prolier/debug mode was enabled …

OK , mình sẽ từ từ dịch hết tất cả các method , các bạn có thể có thể xem bản gốc ở đây : “‘Top 10 web hacking techniques of 2021 — PortSwigger’” Mình dịch blog này , chủ yếu sẽ làm quen với các kỹ thuật exploit mới…

EXPLOIT API với auth token Chủ đề hôm nay là exploit endpoint API sử dụng Authtoken. Không phải là tìm nó Nhiều người chúng ta tìm thấy authtoken trong quá trình tiến trình recon nhưng không biết cách impact của nó và thường bị từ chối. …

Hello everyone ,today I will show you my duplicate report. Bug: Bypass authentication Target is test.com beacause I dont have permisson to disclose My target is web shopping as shopify so I have admin page to control my shop Everything is okay, until I have to signup password for payment…