Password Reset Poisoning Leading to Account TakeoverOverview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i...Jan 16 · 2 min readcybersekler.com
Exposed .git Directory Leading to Source Code Disclosure and Hardcoded CredentialsDuring a web application assessment, I discovered an exposed .git directory that allowed me to download the application's entire source code. By extracting and analysing the git objects, I identified hardcoded credentials that granted admin-level acc...Dec 16, 2025 · 2 min readcybersekler.com
Broken Access Control Leading to Privilege EscalationOverview During a web application penetration test, I identified a broken access control issue that allowed a low-privileged user to escalate their privileges to administrator. The issue was easy to identify and had a high impact, as it allowed full ...May 20, 2025 · 2 min readcybersekler.com
Unauthenticated SQL Injection Leading to Remote Command Execution in a Web ApplicationOverview During a black-box web application penetration test, I identified an unauthenticated SQL injection vulnerability that could be escalated to remote command execution. Although SQL injection vulnerabilities are less common today, this finding ...Nov 16, 2024 · 2 min readcybersekler.com
Web Application Account Compromise via 2FA BypassOverview During a penetration test of a web application, I identified a flawed two-factor authentication implementation that could be bypassed using brute-force techniques. This finding demonstrates that poorly implemented two-factor authentication (...Jul 9, 2024 · 2 min readcybersekler.com
