This article explains how to perform white-box penetration testing on a Python web application running in a Docker container. In this white-box pentest, we will go through how to debug Python in VS...
This article explains some novel techniques for exploiting server-side template injections (SSTIs) with complex, unique payloads that leverage default methods and syntax from various template engin...
Having access to your target’s source code is obviously an invaluable advantage of white-box penetration testing. This article will help you leverage that benefit in the context of PHP application...
In this article, I will cover one of my favorite vulnerabilities of all time and the one that I spent over three months trying to exploit at one of the largest companies in the world (which I unfor...
This article is about a vulnerability that I discovered in a company that I unfortunately cannot name. This company offers a service where other companies can write and share documents online. The ...
In this article we’ll summarise how various active and passive scanning tools can automate and streamline your Burp Suite workflow – saving you time in the process. You can find the full article...
JavaScript, a programming language widely used on the Internet, can be utilized on both the client and server side for development. It’s implemented on almost all web pages. This article will delve...
In this article we will outline various black-box testing techniques and their usefulness in performing offensive tests against web applications. We will also examine the ways in which payloads are...
In this article, we will look at the new BCheck feature in Burp Suite professional that was added in version 2023.6.2. We’ll discuss the benefits and how they can improve Burp’s vulnerability scann...
A web application firewall (WAF) is a program specially designed to filter, monitor and block malicious web requests related to its configurations. The WAF filter and detection department is depen...