Collaborate Disseminate
MongoDB is hosting its developer conference today and unsurprisingly, the company has quite a few announcements to make. Some are straightforward, like the launch of MongoDB 4.2 with some important new security features, while others, like the launch of the company’s Atlas Data Lake, point the company beyond its core database product. “Our new offerings […] Continue reading MongoDB gets a data lake, new security features and more
Seeking any example of exploitable unsafe deserialiazation where the serialized format is json and not some binary format.
Even better would be an example where calling a Java constructor of an arbitrary class(in some commo… Continue reading Unsafe deserialization from JSON
When I am requesting for a password reset, it’s making a request like this ->
{“eval”:”uiFormNotify(‘messageDiv’, ‘info’, ‘msg.email_reset_to_existing’, 10);Metronic.unblockUI(‘#forgotPwdForm’);$(‘#forgotPwdForm’).html($.t(… Continue reading XSS PoC for JSON
I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to:
https://www.googleapis.com/customsearch/v1/siterestrict
I also found … Continue reading Should I report this Google API key disclosure issue or not?
First i want to say that i’m not sure if its called JSON blob,
I found API endpoint on private program which i can convert from JSON to normal GET/POST request with parameters however i have found endpoint which i’m not sure… Continue reading JSON(blob?) to POST/GET request
my question is simply a follow up answer to these two similar threads :
Bruteforce – Using Hydra with JSON
How to run Hydra with json response?
My question is : what if the json file has this text line ?
lockparameters|in… Continue reading Using Hydra with JSON
Lisa Hawke Contributor Share on Twitter Lisa Hawke (@ldhawke) is VP of Security and Compliance at Everlaw, and Vice Chair of Women in Security and Privacy. Slack and other consumer-grade productivity tools have been taking off in workplaces large and small — and data governance hasn’t caught up. Whether it’s litigation, compliance with regulations like […] Continue reading How to handle dark data compliance risk at your company
I have a webpage that is running some javascript that:
Reads in a URL from a URL query param
Without validating the URL, makes a request to it
Validates the response – ensures that the response is a 200 and parses the JSON … Continue reading Loading JSON via an unvalidated URL – is this a vulnerability?
I was trying to recreate a POC where an endpoint didn’t have CSRF protection and was exposing a form submission.
So, I have read these ( before asking here ):
Vimeo hackerone Report by avlidienbrunn
GeekBoy’s Article on JS… Continue reading JSON-CSRF using Flash SWF Doesn’t make POST request
I’m the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, so it’s formatted accord… Continue reading Encoding output in JSON HTTP API