Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Easy
SameSite Lax bypass via method override
csrf with no token, protected only by chrome's default Lax SameSite cookie, bypassed with a top level get navigation that carries the session cookie plus a _method=POST override so the post only email change endpoint accepts it
Cross-site request forgery (CSRF) 4 min -
Easy
CSRF where token is duplicated in cookie
csrf using the insecure double submit technique where the server only checks the form token equals the csrf cookie
Cross-site request forgery (CSRF) 2 min -
Easy
CSRF where token is tied to non-session cookie
csrf where the token is tied to a separate csrfKey cookie rather than the session
Cross-site request forgery (CSRF) 5 min -
Easy
CSRF where token is not tied to user session
csrf where the token is validated but not tied to the user's session
Cross-site request forgery (CSRF) 3 min -
Easy
CSRF where token validation depends on token being present
csrf where the token is only checked when it is present
Cross-site request forgery (CSRF) 2 min -
Easy
CSRF where token validation depends on request method
csrf where the token is only validated on post method
Cross-site request forgery (CSRF) 2 min -
Easy
CSRF vulnerability with no defenses
csrf on an email change with no token and no defenses at all
Cross-site request forgery (CSRF) 3 min