Collaborate Disseminate
I’m conducting a research on web vulnerabilities and how wvs (web vulnerability scanners) work in general
As far as I understood,a typical automated web scanner operates in three main sequential phases:
Spidering / Crawling Phase: The targ… Continue reading What are the main phases that a web vulnerability scanner follow?
SSL Labs says that a website I control supports weak ciphersuites because they have DH 1024 bit, e.g. this one: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f).
I tried to connect to the website from my laptop while Wireshark was… Continue reading Understand DHE security in TLS
I have 2 servers that communicate each other in HTTP and they are both behind an API gateway.
Between the servers and their API gateways the communication is in HTTPS with mutual authentication using certificates, and the sam… Continue reading HTTP body E2E encryption protocol
Why do I see a filler being used in some exploits?
Take as an example the code below:
exploit = junk + eip + nops + shellcode
fill = “\x43″*(BUF_SIZE-len(exploit))
buf = exploit + fill
I guess the buffer is the max number of byte we c… Continue reading Is a filler needed in a buffer overflow exploit?
There is a useful meterpreter script that allows to migrate meterpreter to another process by specifying its PID.
Imagine I have my own session running. How could I migrate to another process without using metasploit?
I know … Continue reading Manually migrate to another process without using metasploit?
When you install a plugin in WordPress you can choose to activate or deactivate it.
Let’s say you have a plugin of which the latest version is vulnerable to XSS for example and you’re waiting for a security fix to be released. Should I di… Continue reading Are inactive vulnerable WordPress plugins still unsafe?