Collaborate Disseminate
Encoding a payload is a means of evading antivirus or IDS.
With regard to scripts is there a way to do the same thing?
For instance, is it possible to encode a python script in order test intrusion prevention systems?
This script here http… Continue reading script encoder for IDS test
I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (or Unicode?).
I have to send the GET i… Continue reading Error Based SQL Injection
I am really trying hard to exploit a Client Side Template Injection vulnerability in a webapp I am currently pentesting. Im so close to getting the payload to be executed, but I am stuck at the last little part^^. Would be great if you cou… Continue reading Angular Expression/XSS-Payload without Quotes or "$"
I have recently participated in a CTF competition and failed in the following stage where the solution was never revealed.
After a really hard job I got access to a text file that contains a really strange set of letters which should guide… Continue reading Steganography CTF question
I have a website that reflects the current url in an opengraph meta tag.
So if the url is :
https://example.com/my/link/here"/><script>prompt(1)</script>
the meta tag should be
<meta property="og:url" conte… Continue reading Is this XSS input being escaped?
I have a log of spam emails collected from various sources, in JSON. The goal is to move it all into plaintext to become a training corpus for a machine learning exercise. Mail subject, etc, is plaintext. Bodies, however, are encoded…
As… Continue reading How do I read an email log that captures bodies in different combinations of encodings plus underlying format
I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a Firestore database.
I have performed chec… Continue reading Sanitising data for a flutter application
A JSON response in the API of a webapp is returning the base64 of a user-uploaded image, and there’s no X-Content-Type-Options Header to prevent MIME sniffing.
Could this be a potential vulnerability such as an XSS for the webapp by using … Continue reading Potential vulnerability in JSON response returning base 64 encoded image data, with the response being vulnerable to MIME sniffing
I’m trying to stack overflow of one C program. But I’m confused by encoding or decoding algorithms.
I used ollydbg to observe registers. I tried entering "a" 28 times. And it should insert the last "a" in the EIP regist… Continue reading How a can be decoded as 61 and b as 62…? [closed]
I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. All of the strings have the following … Continue reading What is LS0… encoding of a PKI certificate?