joelodey.hashnode.devLab: HTTP/2 request splitting via CRLF injectionOur target is to exploit a hypothetical web application, simulating real-world scenarios. To demonstrate HTTP/2 request splitting, we will follow a step-by-step solution provided by the lab: Setup with Burp Suite: Start by sending a request for GET ...Aug 16, 2025·2 min read
joelodey.hashnode.devLab: OS command injection, simple caseLab Scenario: Our objective is to explore and exploit an OS command injection vulnerability in a web application's stock level check feature. By intercepting and modifying a request, we aim to execute arbitrary commands and observe the response, high...May 18, 2025·2 min read
joelodey.hashnode.devLab: Broken brute-force protection, multiple credentials per requestLab Scenario: Our objective is to understand and exploit a web application's broken brute-force protection, where the login credentials are submitted in JSON format. By manipulating the request to submit multiple credentials, we aim to bypass the pro...Nov 17, 2024·2 min read
joelodey.hashnode.devA quick guide to Getting Started in CybersecurityHow to Get Started in Cybersecurity Cybersecurity is one of the fastest-growing fields in the tech industry. It offers a wide range of opportunities to protect businesses and individuals from online threats. If you're interested in getting started, h...Nov 17, 2024·3 min read
joelodey.hashnode.devLab: Exploiting XXE to perform SSRF attacksLab Scenario: Our mission is to exploit XXE through a web application's "Check stock" feature, ultimately performing SSRF attacks to access sensitive information from a metadata endpoint. By intercepting and manipulating a POST request, we intend to ...Nov 8, 2024·2 min read