Password Reset Poisoning Leading to Account TakeoverOverview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i...2 min read·cybersekler.comJan 16
Exposed .git Directory Leading to Source Code Disclosure and Hardcoded CredentialsDuring a web application assessment, I discovered an exposed .git directory that allowed me to download the application's entire source code. By extracting and analysing the git objects, I identified hardcoded credentials that granted admin-level acc...2 min read·cybersekler.comDec 16, 2025
Broken Access Control Leading to Privilege EscalationOverview During a web application penetration test, I identified a broken access control issue that allowed a low-privileged user to escalate their privileges to administrator. The issue was easy to identify and had a high impact, as it allowed full ...2 min read·cybersekler.comMay 20, 2025
Unauthenticated SQL Injection Leading to Remote Command Execution in a Web ApplicationOverview During a black-box web application penetration test, I identified an unauthenticated SQL injection vulnerability that could be escalated to remote command execution. Although SQL injection vulnerabilities are less common today, this finding ...2 min read·cybersekler.comNov 16, 2024
Web Application Account Compromise via 2FA BypassOverview During a penetration test of a web application, I identified a flawed two-factor authentication implementation that could be bypassed using brute-force techniques. This finding demonstrates that poorly implemented two-factor authentication (...2 min read·cybersekler.comJul 9, 2024
