Collaborate Disseminate
Lets say the target company says only *.target.com is in scope.
If i’m doing hosntnames recon, then its easy to stay in scope as only subdomains of target.com is in scope e.g dev.target.com, admin.target.com.
But i have heard pentesters ta… Continue reading How is IP reconaissance different from host names reconaissance?
Let’s say you’re on a pentest (or bug bounty hunting) and you meet a domain that resolves to 127.0.0.1, How can you exploit that? is that even considered a misconfiguration ? sometimes i see domains named like 127-0-0-1.domain.com and it r… Continue reading How can you exploit a website that resolves to localhost?
I have a parameter whose value is injected in the HTML as the following
<script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script>
I was able to traverse back to just / but when I enter my xss hunter payload (let say … Continue reading How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)
What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?