Collaborate Disseminate
To clarify the question, here’s our case:
We generate encrypted tokens by applying AES-CBC (256 bit) and Base64 to payload:
encrypted_token = Base64.encode(AES_CBC_256.encrypt(key, iv, payload)).
These encrypted tokens are publicly availab… Continue reading Can token decryption endpoint response codes variability lead to security vulnerabilities?
This question is out of pure curiosity. I know I can send multipart formposts using curl’s –form/-F option. However, I was curious to see if the same can be done with the –data-binary option? For example, if I run the following script to… Continue reading How to properly use cURL –data-binary to send a request payload
While learning about pentesting most of the time I have used the python3 -m http.server [PORT] command to spin up a temporary http server in order to transfer files to a target system. However as I am progressing and moving beyond the basi… Continue reading How to set up a simple HTTPS server for pentesting [closed]
How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible?
for example, to be clearer, I have my session authenticated i… Continue reading HTTPonly token without CSRF is safe?
A URL is followed by a number. Changing the number will change the content of the web page. Now I know it’s insecure direct object reference (IDOR). What should I do to fix this vulnerability?
Continue reading A URL is followed by number, what is its vulnerability?
Gopher protocol is used a lot when exploiting SSRF, but how?
a Gopher URL takes the form:
gopher://<host>:<port>/<gopher-path>
but let’s take this example:
gopher://10.10.10.3:80/_POST%20/login%20HTTP/1.1%0aContent-Ty… Continue reading SSRF trough Gopher
I’m digging into proxies and VPNs to wrap my head around their security aspects. Wondering: can a proxy server sneak a peek at my raw requests and maybe even tweak them a bit? my connections are HTTPs
Continue reading Can a proxy server view the request and response bodies? [duplicate]
I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder.
I was wondering if there could be a way of … Continue reading Is prohibiting cookies a viable CORS alternative?
Consider clientA which wants to verify payments and serverB which verifies payments.
ClientA sends around a million requests to serverB’s API in 1 day.
However, only 1% of the requests from clientA succeed and give a 200 response. The rest… Continue reading How do you verify if a request is from a genuine user or from a malicious user?
HMAC signatures are very commonly used for webhook authorization from service to consumer.
Examples:
Stripe
Slack
Twilio
Twitter
GitHub
and hundreds and hundreds more. This seems a near universal design decision.
Yet, the other direction… Continue reading Why are HMAC signatures frequently used for webhook authorization but not other HTTP API requests?