This blog focuses on the identification and exploitation of Multi-Factor Authentication vulnerability on web applications. We will be providing a detailed walkthrough of PortSwigger's labs which you can access on the PortSwigger website.

This blog focuses on the identification and exploitation of Authentication vulnerability on web applications. We will be providing a detailed walkthrough of PortSwigger's labs which you can access on the PortSwigger.

We have come up with a new machine, "Clocky," on TryHackMe, which aims to familiarize you with the process of detecting misconfigurations on Linux-based web servers using an array of penetration testing tools and methods.

This blog emphasizes the identification and exploitation of Cross-site Scripting (XSS) vulnerabilities present on websites.

This blog centers on the identification and exploitation of DOM-based XSS vulnerabilities present on websites. We'll be honing our skills in detecting and leveraging these vulnerabilities using the PortSwigger platform.

This blog explores how to detect and take advantage of advanced DOM-based XSS vulnerabilities found in websites that utilize third-party dependencies

Broken access controls are prevalent and frequently pose a critical security vulnerability. Vertical privilege escalation occurs when an attacker endeavors to obtain additional permissions or access using a compromised existing account.

Horizontal access controls are systems designed to limit access to resources to particular users. This blog focuses on the identification and exploitation of “Horizontal Privilege Escalation”, which is a type of Broken Access Control vulnerability

Insecure Direct Object References (IDOR) represent a form of broken access control vulnerability, wherein an application inadvertently reveals direct references to internal objects, such as database keys or file paths, exposing sensitive information.

Union SQL injection involves an attacker to get the contents of other tables stored in the database with the default SQL queries.

In this new writeup we will understand how we can get the database version and information related to tables and columns present in the database.

Hello folks,

'; (SELECT pg_sleep(10))––

'––

In this blog, we are going to solve a challenge that will test our client-side exploitation skills. The name of this challenge is “Whats Your Name?” and it is available on the TryHackMe platform.

In this blog, we will solve the “Basic password reset poisoning” lab under Password Reset Poisoning.

This Lab focuses on the identification and exploitation of HTTP Host header vulnerability. We will understand this vulnerability and then see how we can perform password reset poisoning via middleware.

To solve the Lab, we must identify the exposed API documentation and delete a user from the application. We will require the Burp Suite Community edition to solve the lab.

In this blog, we will understand the complete process which starts from identifying API endpoints, supported HTTP methods, and content types.