Automating xss identification with Dalfox & Paramspider

InfoSec Write-ups - Medium-- Cross Site Scripting allows an attacker to inject malicious javascript code in the web application through some parameters and can be escalated further to perform attacks such as cookie stealing , session hijacking etc.Types of XSS:Reflected XSSStored XSSDOM Based XSSHow it all started?I recently got an invite for a private program on BugCrowd and I … Continue reading Automating xss identification with Dalfox & Paramspider

HTTP Headers : Web App Security Basics

InfoSec Write-ups - Medium-- HTTP Headers : Web App Security BasicsHTTP headers let the client and the server pass additional information with an HTTP request or response. An HTTP header consists of its case-insensitive name followed by a colon, then by its value.Example:Strict-Transport-Security: max-age=31536000Some HTTP headers that are indirectly related to privacy and security, can also be considered … Continue reading HTTP Headers : Web App Security Basics

TryHackMe: GamingServer Write-up

InfoSec Write-ups - Medium-- TryHackMe: GamingServer Write-upBeginners CTF ChallengeThis is a write-up of GamingServer, a THM beginner-level challenge. Without any delay, let’s connect to our THM OpenVPN network and boot our machine.Task 1 Boot2RootScan your network using Nmap.nmap -A <machine-ip>Nmap scan results2. There are two open ports. Let us see what is in the HTTP(80) port.http page3. Looks like … Continue reading TryHackMe: GamingServer Write-up

Grype – A Vulnerability Scanner For Container Images And Filesystems

KitPloit - PenTest Tools!-- A vulnerability scanner for container images and filesystems. Easily install the binary to try it out. Features Scan the contents of a container image or filesystem to find known vulnerabilities. Find vulnerabilities for major operating system packages Alpine BusyBox CentOS / Red Hat Debian Ubuntu Find vulnerabilities for language-specific packages Ruby … Continue reading Grype – A Vulnerability Scanner For Container Images And Filesystems

Keeping ransomware cash away from your business

Malwarebytes Labs-- A ransomware gang has made headlines for donating a big chunk of stolen funds to two charities. Two separate donations given to Children International and The Water Project rang tills to the tune of $10,000 each. Their reason was that they’re targeting “only large profitable corporations, we think it’s fair that some of … Continue reading Keeping ransomware cash away from your business

TASER – Python3 Resource Library For Creating Security Related Tooling

KitPloit - PenTest Tools!-- TASER (Testing And SEecurity Resource) is a Python resource library used to simplify the process of creating offensive security tooling, especially those relating to web or external assessments. It's modular design makes it easy for code to be customized and re-purposed in a variety of scenarios.Key features Easily invoke web spiders … Continue reading TASER – Python3 Resource Library For Creating Security Related Tooling

Google Removes 21 Malicious Android Apps from Play Store

The Hacker News-- Google has stepped in to remove several Android applications from the official Play Store following the disclosure that the apps in question were found to serve intrusive ads. The findings were reported by the Czech cybersecurity firm Avast on Monday, which said the 21 malicious apps (list here) were downloaded nearly eight million times from … Continue reading Google Removes 21 Malicious Android Apps from Play Store