Collaborate Disseminate
I came across a scenario where an organization is using micro-service architecture. They are using Amazon AWS as a web service and Kubernetes to maintain micro-services. All the EC2 instances are in private subnet. You have t… Continue reading Black Box penetration testing in private network
I have some security problems to solve, and frankly, don’t even know where to start. I’d appreciate some feedback from the experts here…
Problem 1: Protecting API keys that have rights to withdraw crypto currencies from … Continue reading How to make a "blackbox" secure enough to process high dollar crypto currency withdrawals?
How would I (or) what software would I use to conduct local application (stored on the PC) black-box (no source/closed source) fuzzing or vulnerability testing for Windows? I’ve just been using common sense, like using negati… Continue reading How to preform black-box (no source) vulnerability testing/fuzzing?
Is there any way to identify which built-in PHP function is used in some given script only by sending a request and receiving a response from the remote server?
To keep it simple we might assume that it is very simple PHP sc… Continue reading Correlation between server request and response time and built-in php functions
Intro
I’m currently experimenting with PHP black box analysis and couldn’t find any useful information. There are some approaches how to determine e.g. Apache version, but for PHP it seems that internet knows only so called … Continue reading Guessing PHP version and info from phpinfo using black box analysis
I’ve stumbled upon CBEST framework for Intelligence based penetration testing methodology developed by the Council of Registered Ethical Security Testers (CREST), cyber intelligence company Digital Shadows in collaboration wi… Continue reading What is Bank of England’s (BoE) CBEST framework?
I’ve stumbled upon CBEST framework for Intelligence based penetration testing methodology developed by the Council of Registered Ethical Security Testers (CREST), cyber intelligence company Digital Shadows in collaboration wi… Continue reading What is Bank of England’s (BoE) CBEST framework?
I am testing a scenario with Burp proxy.
I am located on a website https://website.com/web
There’s an option there to delete an item, when you click it , a certain POST request is sent (XMLHttpRequest, no page refresh is ha… Continue reading Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?
I am testing a scenario with Burp proxy.
I am located on a website https://website.com/web
There’s an option there to delete an item, when you click it , a certain POST request is sent (XMLHttpRequest, no page refresh is ha… Continue reading Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?
I am testing a scenario with Burp proxy.
I am located on a website https://website.com/web
There’s an option there to delete an item, when you click it , a certain POST request is sent (XMLHttpRequest, no page refresh is ha… Continue reading Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?