Archives
Unknown
- --AWS Cloud Red Teaming Writeup
- --Azure Cloud Red Teaming Writeup
- --GCP Cloud Red Teaming Writeup
- --Teoria vs Practica Cloud Red Team
- --LABS
- --1 Username enumeration via different responses
- --10 Offline password cracking
- --11 Password reset poisoning via middleware
- --12 Password brute force via password change
- --13 Broken brute force protection, multiple credentials per request
- --2 2FA simple bypass
- --3 Password reset broken logic
- --4 Username enumeration via subtly different responses
- --5 Username enumeration via response timing
- --6 Broken brute force protection, IP block
- --7Username enumeration via account lock
- --8 2FA broken logic
- --9 Brute forcing a stay logged in cookie
- --CORS vulnerability with basic origin reflection
- --CORS vulnerability with trusted null origin
- --DOM XSS in AngularJS expression with angle brackets and double quotes HTML encoded
- --DOM XSS in document.write sink using source location.search inside a select element
- --DOM XSS in document.write sink using source location.search
- --DOM XSS in innerHTML sink using source location.search
- --DOM XSS in jQuery anchor href attribute sink using location.search source
- --DOM XSS in jQuery selector sink using a hashchange event
- --Reflected DOM XSS
- --Reflected XSS into a JavaScript string with angle brackets HTML encoded
- --Reflected XSS into attribute with angle brackets HTML encoded
- --CSRF vulnerability with no defenses
- --CSRF where token validation depends on request method
- --Manipulating WebSocket messages to exploit vulnerabilities
- --Basic clickjacking with CSRF token protection
- --Clickjacking with a frame buster script
- --Clickjacking with form input data prefilled from a URL parameter
- --Exploiting clickjacking vulnerability to trigger DOM based XSS
- --Authentication bypass via OAuth implicit flow
- --Forced OAuth profile linking
- --OAuth account hijacking via redirect uri
- --SSRF via OpenID dynamic client registration
- --Stealing OAuth access tokens via an open redirect
- --JWT authentication bypass via algorithm confusion with no exposed key
- --JWT authentication bypass via algorithm confusion
- --JWT authentication bypass via flawed signature verification
- --JWT authentication bypass via jku header injection
- --JWT authentication bypass via jwk header injection
- --JWT authentication bypass via kid header path traversal
- --JWT authentication bypass via unverified signature
- --JWT authentication bypass via weak signing key
- --1 Limit overrun race conditions
- --2 Bypassing rate limits via race conditions
- --3 Multi endpoint race conditions
- --4 Single endpoint race conditions
- --5 Exploiting time sensitive vulnerabilities
- --6 Partial construction race conditions
- --HTTP request smuggling, confirming a CL.TE vulnerability via differential responses
- --Modifying serialized objects
- --Excessive trust in client side controls
- --Exploiting server side parameter pollution in a REST URL
- --Insecure direct object references
- --User ID controlled by request parameter
- --User role can be modified in user profile
- --SSRF with whitelist based input filter
- --SSRFagainstAnotherBackendSystem
- --Exploiting cache server normalization for web cache deception
- --Exploiting exact match cache rules for web cache deception
- --Exploiting origin server normalization for web cache deception
- --Exploiting path delimiters for web cache deception
- --Exploiting path mapping for web cache deception
- --Basic password reset poisoning
- --Host header authentication bypass
- --OS command injection, simple case
- --Blind SQL injection with conditional errors
- --Blind SQL injection with conditional responses
- --Blind SQL injection with out of band interaction
- --Blind SQL injection with time delays and information retrieval
- --SQL injection UNION attack, determining the number of columns returned by the query
- --SQL injection UNION attack, finding a column containing text
- --SQL injection UNION attack, retrieving data from other tables
- --SQL injection UNION attack, retrieving multiple values in a single column
- --SQL injection attack, listing the database contents on Oracle
- --SQL injection attack, listing the database contents on non Oracle databases
- --SQL injection attack, querying the database type and version on MySQL and Microsoft
- --SQL injection attack, querying the database type and version on Oracle
- --SQL injection vulnerability allowing login bypass
- --SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
- --SQL injection with filter bypass via XML encoding
- --Visible error based SQL injection
- --Exploiting XXE to perform SSRF attacks
- --Exploiting XXE to retrieve data by repurposing a local DTD
- --Exploiting XXE using external entities to retrieve files
- --Exploiting blind XXE to exfiltrate data using a malicious external DTD
