Collaborate Disseminate
I have researched and found the following sites which will break captchas:
anticaptcha
2captcha
(links not included to prevent promoting the sites)
Given that these services can be used to break captchas, what is the ben… Continue reading What benefit do Captchas provide?
I have a nodejs server app that is running under pm2 (pm2 is a process manager). And today out of the blue, the app crashed and restarted several times in 2-3 minutes. So I looked at the pm2 logs to see why, and I saw the wei… Continue reading File contents that are not actually there
While we know that in the best practice in any AES communication is to not use a constant or all zero IV.
However, when I capture my authentication progress between my STA and AP. I found out that the EAPOL message of 1, 2 a… Continue reading WPA2 IV all zero in EAPOL message of 1,2 and 4
I need to broadcast a message (i.e. post it publicly) from device X, and have it understood by an unknown number of other devices (so the ciphertext is visible to all devices, and a subset of all devices should be able to dec… Continue reading Authenticity and confidentiality of a broadcasted message
I’m trying to adopt a compartmentalized setup without making my daily work too complicated.
My current setup:
Physical machine running Linux.
Windows VM – work related, for some of my clients where I have to use Windows, V… Continue reading Personal work environment using virtual machines
I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn’t been updated in a while and doesn’t use HTTPS to encrypt data in transit. The website does not have any authentication mechanism i… Continue reading E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout
<img class=”avatar” src=”MY INPUT SPACE”>
I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two characters are filtered but … Continue reading Bypassing <, > XSS filter
I know that filtering bad keyword is not a good approach to preventing SQL injection. However, when I couldn’t answer why this is not a good approach, here is my rule:
1) When I see ;, I make it to ” (So that no one can ma… Continue reading SQL injection evasion
I’m pentesting a server infrastructure, and I already got in as an unprivileged user. I can run commands but some commands don’t work, due to the nature of the reverse shell.
Using netstat I can see a server admin webapp ru… Continue reading Outbound proxy/reverse-shell as a way to bypass firewall
I’m by now means an expert in this field, or even well versed, but if it’s possible to do this, I can’t comprehend how Paypal allows it.
Say you have 2 factor authentication on, with your phone setup as the Device.
You lose… Continue reading Is Paypal’s 2FA Security really this bad?