one2bla.me

Discovering running services After using reconnaissance to define our web application target’s presence on the internet, we aim to enumerate the target’s services ...

In this section, we’ll cover some common ways of discovering SQL injection vulnerabilities in a web application.

Web applications have to store user data so that, when you login, they can restore your session, settings, etc.

If we get our hands on the compiled byte code for web technologies like C# and Java, we can use various tools to recover the original source code that convert the application’s byte code ...

Approaches Two central approaches are pretty useful for discovering bugs in a web application during source code analysis: a top-down approach and a bottom-up approach ...

Server-side template injection (SSTI) is a vulnerability where a server uses an attacker’s input to render a template but fails to sanitize the content provided, enabling the attacker ...

Server-side request forgery (SSRF) is a scenario in which the attacker can coerce the vulnerable server to make requests to other hosts on the attacker’s behalf ...

Debugging Python web applications Usually, Python web applications aren’t distributed in some sort of “compiled” release format - but they can be.

Useful configuration files Java web applications map API routes to Java servlets, as described in our Source code analysis methodology notes.

Advanced file access with CDATA We initially discuss XML External Entities (XXE) exploits in XML External Entities, Retrieving Files, however, the examples provided don’t account ...