Category Archives: web-application

How to escalate or make a Self-XSS vulnerability more impactful when injecting a payload into the X-Forwarded-For header of a web request?

Posted on by

I’m a beginner bug bounty hunter, and I recently came across a Self-XSS vulnerability during my security testing on a target website. The vulnerability occurs when I inject a payload into the X-Forwarded-For header of a web request. Howeve… Continue reading How to escalate or make a Self-XSS vulnerability more impactful when injecting a payload into the X-Forwarded-For header of a web request?→

DIY attack surface management: Simple, cost-effective and actionable perimeter insights

Posted on by

Modern-day attack surface management (ASM) can be an intimidating task for most organizations, with assets constantly changing due to new deployments, assets being decommissioned, and ongoing migrations to cloud providers. Assets can be created and for… Continue reading DIY attack surface management: Simple, cost-effective and actionable perimeter insights→

Unmasking the limitations of yearly penetration tests

Posted on by

In this Help Net Security interview, Charles d’Hondt, Head of Operations, Ambionics Security, talks about the necessity of implementing continuous penetration testing because yearly ones are not enough. They leave blind spots and cannot match the… Continue reading Unmasking the limitations of yearly penetration tests→

Optimal way to securely store password on client with server invalidation but not knowledge

Posted on by

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
I have what is essentially a stateless… Continue reading Optimal way to securely store password on client with server invalidation but not knowledge→