Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Easy
Exploiting XXE to perform SSRF attacks
xxe turned into ssrf by pointing the external entity at the ec2 metadata endpoint
XML external entity (XXE) 3 min -
Easy
Exploiting XXE using external entities to retrieve files
xxe where the stock check parses our xml and reflects unexpected values
XML external entity (XXE) 2 min -
Easy
CORS vulnerability with trusted insecure protocols
cors that trusts any subdomain over any protocol, chained with a reflected xss on an insecure http stock subdomain to run the credentialed accountDetails read from a trusted origin and exfiltrate the admin api key
Cross-Origin Resource Sharing (CORS) 3 min -
Easy
CORS vulnerability with trusted null origin
cors that trusts only the null origin
Cross-Origin Resource Sharing (CORS) 4 min -
Easy
CORS vulnerability with basic origin reflection
cors misconfiguration that reflects any origin and allows credentials
Cross-Origin Resource Sharing (CORS) 3 min -
Easy
Clobbering DOM attributes to bypass HTML filters
dom clobbering that breaks the HTMLJanitor sanitizer by injecting <input id=attributes> to clobber a form's attributes property so the filter loop fails and an onfocus=print() form survives
DOM-based vulnerabilities 3 min -
Medium
Exploiting DOM clobbering to enable XSS
dom clobbering that turns safe html only comments into xss, using two id=defaultAvatar anchors to clobber window.defaultAvatar so its avatar property is an anchor href that breaks out of the unescaped img src and adds an onerror=alert(1)
DOM-based vulnerabilities 4 min