Collaborate Disseminate
I recently received several emails from a security researcher, one for each "vulnerability" that he had discovered on my website. These alleged vulnerabilities were respectively: a missing certificate authority, no valid SPF, and… Continue reading Dealing with an independent security researcher [closed]
when I open the burpsuite proxy, it kept hit me with recaptcha , after I click submit, another one pop up, and another, and another, and so on what is wrong?
Continue reading unable to pass recaptcha test using burpsuite proxy
I recently find out that when selecting a web path scanner, the following features should be considered, in order of importance.
Functionality
If you can’t get it to run on your system, it’s no good to you.
Dictionaries
The larger the dict… Continue reading Web path scanner evaluation criteria [closed]
There are many tools designed to brute force directories and files in webservers, for example:
https://tools.kali.org/web-applications/dirbuster
https://github.com/maurosoria/dirsearch
https://github.com/pyno/dirfy
https://github.com/OJ/g… Continue reading How to choose a web path scanner?
There are many tools designed to brute force directories and files in webservers, for example:
https://tools.kali.org/web-applications/dirbuster
https://github.com/maurosoria/dirsearch
https://github.com/pyno/dirfy
https://github.com/OJ/g… Continue reading Which is the fastest web path scanner? [closed]
Let’s say an IP address hosts multiple domains, (example.com, example.net, example.org, etc.). How do I port scan a specific domain?
In order to better protect my Django web app, I want to reduce the leakage of information that could help an attacker profile my application. If you were an attacker, what would you look at to identify a Django web app?
From OWASP, I know … Continue reading How can you fingerprint a Django web app?
Just as the title says. Not shodan. I want 98% live hosts. I know about zenmap and proxychains but using that would make it take forever.
What do you think?
Continue reading What is the best way to mass scan the country without the ISP noticing? [closed]
I recently saw a very interesting post from a person describing all the steps he would take before running a scan (https://groups.google.com/g/zaproxy-users/c/SMd9OmcVWbE). It caught my attention because I do exactly the same thing he does… Continue reading Doesn’t seem to change _csrf token
Say you have the following files/folder in your webserver:
public_html/index.html
public_html/test/index.html
public_html/test/foo-randomString.jpg
For an average user, foo-randomString.jpg can’t be seen unless they know the exact filena… Continue reading Can a web crawler still see files in a directory even with an index file? [closed]