Shay Rand

@Shay

Penetration Tester

IsraelJoined October 2021

About

I am a Web Application Security Consultant and Pen Tester. I'm currently part of the AppSec team at Maglan - Accenture Security. All Views are my Own.

Available for

Nothing here yet.

Shay Rand's blogs

RedMethodredmethod.hashnode.dev9 posts

Articles Threads Comments

Recently published

redmethod.hashnode.dev

How to Discover SQL Injections

The process of finding SQL injection vulnerabilities involves identifying user data entry, tampering with the data sent to the application, and identifying changes in the results returned by the server. You have to keep in mind that tampering with th...

Jan 9, 20238 min read

redmethod.hashnode.dev

Testing File Upload Mechanism

This past week I had the opportunity to test a file upload feature which only allowed pdf files to be uploaded. I tried to bypass the filter by appending a second filetype to the filename test.pdf.svg But I still received an error. After some trial a...

Jul 7, 20229 min read

redmethod.hashnode.dev

XXE - Underrated?

Disclaimer: The content of my articles is truly the hard work of researchers in the field who have put the time and energy to discover these great attack vectors. Im only gathering the materials they have written and presenting it in a manner that I ...

Jul 6, 20224 min read

redmethod.hashnode.dev

CSRF Revisited

Pre-Conditions Portions of this article have been copied from Portswigger Academy. There are many other tips and bypasses that have been added from other resources to help aid bug hunters and pentesters. For a CSRF attack to be possible, three key ...

Jul 5, 20226 min read

redmethod.hashnode.dev

SSRF Demystified

Introduction Server Side Request Forgery can technically be viewed as an Authorization issue as you are manipulating the server to make requests on your behalf. Often the server will have authorization to resources you don't have (Think http://localh...

Jul 4, 20227 min read

Shay Rand

About

Available for

Shay Rand's blogs

Recently published

How to Discover SQL Injections

Testing File Upload Mechanism

XXE - Underrated?

CSRF Revisited

SSRF Demystified

Search Hashnode

Shay Rand

About

Available for

Shay Rand's blogs

Recently published

How to Discover SQL Injections

Testing File Upload Mechanism

XXE - Underrated?

CSRF Revisited

SSRF Demystified