Application Security Testing for the SQL Injection. INTRODUCTION The article describes how to test the application to find SQL Injection vulnerabilities. The advice in this article is based on the following: OWASP Web Security Testing Guide OWASP Application Security Verification Standard Bug bounty reports Own experience. TOOLING Tools with basic usage instructions…

Setting up the environment for testing and crimson_recon explanation. INTRODUCTION It has been a couple of months since the last article about the automatization of Web Application Penetration Testing. …

How to fool the Microsoft Defender and other anti-virus systems. INTRODUCTION During the Penetration Testing, if you come across a Windows OS, in most cases it will be protected at least by the basic anti-virus system called "Microsoft Defender". …

How to automate the 2FA Google Authenticator using Burp Suite. INTRODUCTION This article describes how to automate the process that needs the 2FA code from Google Authenticator mobile app using the Burp Suite extension called Google Authenticator. HOW GOOGLE 2FA WORKS The Google Two-Factor Authentication (2FA) code required for logging in is calculated automatically using…

Application Security Testing for the Cross-Site Scripting. INTRODUCTION The article describes how to test the application to find Cross-Site Scripting vulnerabilities. The advice in this article is based on the following: OWASP Web Security Testing Guide OWASP Application Security Verification Standard Bug bounty reports Own experience. TOOLING Tools with basic usage instructions…

Methodology for Input Validation Testing in web applications. INTRODUCTION The article describes the methodology for Input Validation Testing in web applications in the various application fields. This article will be a general introduction to input validation testing, the next ones will describe specific vulnerabilities, e.g.,. XSS, SQLi. The advice in this…

Buffer overflow and shell coding [x32] — This walkthrough refers to the methodology described here. It will be: concise, straight to the point. without the steps that lead to the rabbit hole. 0. Download the binary:

Article about — how to prepare for the WEB-300 course and OSWE exam. INTRODUCTION This article is a short guide on preparation for the WEB-300 course and the OSWE exam. There are links to blogs, tools, other courses, exercises, and all kinds of sources I used for my preparations. WEB 300 — DESCRIPTION To make…

CSP default-src ‘self’ — bypass using the error page. INTRODUCTION During one of the penetration tests, I managed to chain three application issues that finally enabled the execution of the Stored XSS vulnerability. The vulnerability combines three flaws in the application: Unrestricted file upload. Misconfigured Content Security Policy. Application error response…