XXEinjector is a tool that automates the process of exploiting a security error consisting in the ability to inject external entities into xml files (XML eXternal Entity). It allows, among other things, downloading and uploading files directly and using an intermediary server, enumering files and directories, or enumering un filtred… Continue reading →
Have you heard of data leaks from AWS S3 backets? The same leaks can be found in AliYun OSS backets! Wojtek created the first Aliyun OSS security checker tool, which is available on his githubie: AliYun
Although the design of Prussia undoubtedly has a large number of advantages, there will also be disadvantages in it. One of them is the lack of own lighting. As a night printer, I decided to eliminate this problem by mounting one using LED tape. For my project I used: printed… Continue reading →
Until recently, I knew almost nothing about the existence and operation of mechanical watches. Infected by my brother's passion for this subject, I decided to study the knowledge in this field. That's how I found a very substantive channel about watches by Krzyśk Humeniuk – TikTalk It went on fast…. Continue reading →
As part of my thesis, I had the opportunity to conduct a full penetration test of a commercial web application written using ASP.NET. The result of my research is a report, which I decided to share in a "shaded" form with a wider range of people. Materials of this type… Continue reading →
An experienced pentester, he knows that a well-written report is characterized by the fact that after its presentation the client does not have any additional questions. To do this, it should contain at least four basic sections with information for different audiences. Section 1: General information and statistics While a… Continue reading →
SQL injection attacks involve inserting or "injecting" SQL queries through client input to the application. A successful attack of this type can be used to read sensitive information from the database and modify or delete it. In the most extreme cases, it allows you to issue system commands. The following… Continue reading →
XSS is an attack that allows you to inject and execute malicious HTML or JavaScript. This can be used to steal critical data (for example, session data) from cookies. As the code is executed in the context of a vulnerable application, this allows you to perform other attacks such as… Continue reading →
A cross site request forgery (CSRF) attack exploits the generally accepted logic of web browsers for managing a user session in open pages. The standard is that a user can only have one active session in the web application they are currently using. Any newly opened tab in your browser… Continue reading →
Pathtraversal vulnerability ised to see if a web application allows unauthorized access to files or directories that should be denied access. This type of attack uses parameters passed to the application that show the paths to the resources on which specific operations are performed, such as reading, writing, or displaying… Continue reading →
Cześć podróżniku!
Jestem Michał. Cyberbezpieczeństwo jest moją pasją i pracą. Hobbystycznie zajmuję się drukiem 3d. W ramach tej strony staram się dzielić się wiedzą właśnie z tych obszarów. Mam nadzieję, że znajdziesz tutaj przydatne dla siebie informacje :)
Więcej o mnie...
Subscription
Wspieraj tę stronę
Jeżeli podoba Ci się moja twórczość możesz mnie wesprzeć kawą :)
