What is an SQL injection attack?

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

امروز با امیر صحبت کردم، امیر تازه این فیلدو شروع کرده ولی به نتیجه‌ای رسیده که بچه‌ها تو ۲ سال انتظار دارن برسن، چی شده که امیر زودتر نتیجه گرفته؟ خودم کنجکاو بودم تو این مصاحبه، نسب به مصاحبه قبل بیشتر مصاحبه شونده رو تحلیل کردم، امیدوارم خوشتون بیاد، اگه…

The postMessage API enables secure and efficient communication between different windows, tabs, iframes, or between parent and child…

CSRF exploits user trust to trigger unauthorized actions. This article explores advanced bypass techniques and ways to strengthen defences.

پیشتر یه قسمت از کلاس هانت رو گذاشتم، امروزم یه قسمت از کلاس اوسپت رو میذارم برای بچه‌هایی که میخوان خودشون برن این سناریو رو تمرین کنن، دمتون گرم

This post assumes the reader has some knowledge on HTML, JavaScript (JS), and Cross-site scripting (XSS). I still try to explain some of…

Occurs when unsanitized user input is directly manipulated in the DOM and executed as JavaScript.

One of the great disservices done by modern education is that it programs us to worry about fixing our weaknesses not doubling down on our strengths. If you have a student that excels in Math and Physics, but does terribly in English Literature, what do you…

Hey everyone! After a little break, I’m back and excited to share an amazing story about finding a serious vulnerability. This one’s a real…

There’s always more to do…

I recently came across an nginx server that had a vulnerable alias configuration which allowed anyone to read files outside the intended directory. In the following post I will describe the misconfiguration and provide demo files so that you can experiment…

This blog post discusses a technique that can be used to bypass CSP (Content Security Policy).