HTTP Request Smuggling (HRS) is a type of attack that is gaining more and more attention in recent years. Its rise is fueled by the high prevalence of Cloud-based applications […]
Category: Articles
XXE Attacks Explained
Out of the many attacks that threaten web applications today, XXE remains the one that is talked about the least. Although it gets far less attention than XSS or SQL […]
CSRF (Cross-Site Request Forgery) Explained
Cross-Site Request Forgery (CSRF or XSRF), also called Client-Side Request Forgery, is a type of attack that targets web applications. It allows an attacker to induce users into accessing and […]
A Quick Guide To Regular Expressions
Regular expressions are present in almost all programming languages (Python, PHP, Javascript…), as well as in Linux commands (grep, sed…) and in many other high-level languages and applications. So, why […]
Introduction to Cross-Site Scripting (XSS)
This article presents a great introduction for anyone trying to learn about Cross-Site Scripting (or XSS). You don’t need to be an expert to follow along. However, you do need […]
Using THC Hydra To Brute Force Login Forms
THC Hydra is a powerful tool to use against login forms. It can perform brute force and dictionary attacks against different types of applications and services. When a web application […]
Linux Privilege Escalation: Three Easy Ways to Get a Root Shell
Once you’ve gained access to a Linux system, the next logical step is to perform privilege escalation. That is, to go from a user account with limited privileges to a […]
Using John The Ripper To Crack Password Hashes
Every self-respecting pentester should have a powerful password cracker in their toolkit, and John the Ripper is simply the best cracker out there. Initially released in 1996 by Openwall, John […]
Using Gobuster to Find Hidden Web Content
Directories and Files enumeration is one of the first steps that an attacker performs during web application pentesting. This step is necessary to identify potential hidden areas of a website […]
Introduction to SQL Injection
SQL injection is often referenced as the most common type of attack on websites. It is being used extensively by hackers and pen-testers on web applications. The OWASP Top Ten […]