Website Source Code Analysis To AWS Account Takeover
Unveiling the risks of website source code analysis led to the discovery of AWS access/secret keys resulting in the takeover of an organization's AWS account.
Recent Posts
Cloudflare transform rules to get an A+ in the security header.
Getting A+ grade in securityheaders.com for a static website using Cloudflare transform rules.
Exploiting thousands of Domains for XSS
Exploiting goDaddy service to affect thousands of domains with cross-site scripting vulnerability.
How I bypassed PHP functions to read sensitive files on server
Bypassing file read restriction on an application to achieve Remote Code Execution.
MSSQL Injection In JSON Request
MSSQL Injection in android application from JSON Request.
Blind XSS on Google Internal System
Blind cross-site scripting (XSS) refers to a type of code injection where an attacker inserts XSS payload in user input fields and...
GraphQL IDOR in Facebook streamer dashboard.
While viewing our stream dashboard data from creator studio, there is an endpoint from where we can see our dashboard status. There is parameter called profile_id which can be misused to access dat...
Stored Cross Site Scripting on Mdaemon Webmail (20.0.0)
XSS on Mdaemon webmail affecting versions < 20.0.0. Assigned CVE-2020-18723 and CVE-2020-18724
CVE-2020-10596 in OpenCart
Authenticated Stored Cross Site Scripting (XSS) in OpenCart 3.0.3.2.