Assuming that the server takes actions based on a certain condition, let’s analyze a scenario where the server performs computations depending on the result of that condition and then returns a response to the user. In both cases, whether the computations are performed or not, the server returns a response… Continue reading →
In the context of the growing role of artificial intelligence (AI) in various fields, the question of its impact on the job market in cybersecurity is becoming increasingly relevant. On one hand, automation and intelligent systems can significantly speed up and streamline processes related to data and IT infrastructure protection…. Continue reading →
This post was inspired by the excellent presentation by Jan Seredynski from THS 2023. Cybersecurity is not a binary issue – there are no solutions that guarantee 100% security. In reality, it is more about risk assessment and choosing solutions that are less vulnerable to attacks. An example of such… Continue reading →
The illusion of security is worse than the awareness of its absence because it leads to decisions made on false premises. Information conveyed by public trust institutions such as “We protect your personal data” often creates this illusion of security. Let’s study two examples of this using password-protected PDF files…. Continue reading →
Cybersecurity certifications are becoming an indispensable part of any IT specialist’s career. On various forums, many beginners ask similar questions: “Is certificate A or B a good choice?” While certifications don’t guarantee employment as money doesn’t guarantee happiness, they can significantly enrich your resume when entering the job market. Proper… Continue reading →
Many file formats, besides presenting content, such as JPEG showing a taken photo, can contain metadata. This hidden information can be invaluable during OSINT investigations and penetration tests. Let’s look at some cases and tools useful for extracting these seemingly hidden pieces of information. Not Cleaning Metadata from Photos The… Continue reading →
This post is a supplement to my presentation at The Hack Summit 2023, where I will demonstrate how to accelerate and streamline web application penetration testing using several plugins for Burp Suite. Below is a compilation of the most useful plugins for Burp Suite that I personally use. Some of… Continue reading →
The situation is as follows — the FFUF has found several dozen/several hundred "hidden" resources. You can manually copy addresses to your browser to check each one for interesting results or automate the whole process a bit. I recommend this second approach and i will add a ready-made script, which… Continue reading →
"Some content on websites is seemingly hidden – that is, without their address, we are not able to access it. Often these are some remnants still from the stage of application development – the developer was supposed to remove them later, but forgot ̄_(ツ)_/ ̄ ." – it's a mention… Continue reading →
"Unrestricted File Upload" is one of my favorite group of web application vulnerabilities. This is because if I can locate this type of security error, it usually leads to remote control of the server. If you can upload images, why not try to upload an executable file on the server… Continue reading →
Cześć podróżniku!
Jestem Michał. Cyberbezpieczeństwo jest moją pasją i pracą. Hobbystycznie zajmuję się drukiem 3d. W ramach tej strony staram się dzielić się wiedzą właśnie z tych obszarów. Mam nadzieję, że znajdziesz tutaj przydatne dla siebie informacje :)
Więcej o mnie...
Subscription
Wspieraj tę stronę
Jeżeli podoba Ci się moja twórczość możesz mnie wesprzeć kawą :)
