@cybernerddd

Emmanuel Agyarko Ampah

@cybernerddd

Website

Don’t wait for the breach to teach

Accra, GhanaJoined July 2025

About

Nothing here yet.

Available for

Nothing here yet.

Emmanuel Agyarko Ampah's blogs

cybernerdddfrom-zero-to-cyber.hashnode.dev6 posts

Articles Comments

Recently published

EAEmmanuel Agyarko Ampahfrom-zero-to-cyber.hashnode.devNov 27, 2025 · 2 min read

Payload of The Day #5 - SQL Injection via XML + WAF Bypass (PostgreSQL Edition)

By Cybernerddd - Web App Pentester in Training Today’s payload is straight from a real PortSwigger lab where the SQL injection happens inside an XML POST request, protected by a WAF that blocks the usual keywords like UNION, SELECT, and comments. Sce...

EAEmmanuel Agyarko Ampahfrom-zero-to-cyber.hashnode.devNov 26, 2025 · 2 min read

Payload Of The Day #4 - Blind SQL Injection (Time-Based User Extraction)

By Cybernerddd Blind SQL Injection is one of the most fascinating parts of web exploitation because the application gives no visible output, yet you can still extract data silently using logic, timing, and creativity. Today’s payload focuses on time-...

EAEmmanuel Agyarko Ampahfrom-zero-to-cyber.hashnode.devSep 17, 2025 · 2 min read

Payload #3 - Bypassing File Upload Restrictions with web.config + Custom Extension.

Reference: portswigger file upload via extension blacklist bypass The Situation You're facing a file upload filter that: Blocks .php, .phtml, .php5, etc. Serves uploaded files as plain text. Uses IIS(Internet Information Services) under the hood (...

EAEmmanuel Agyarko Ampahfrom-zero-to-cyber.hashnode.devAug 14, 2025 · 1 min read

Payload #2 – CSRF Auto-Submit Email Change (No Defense)

This is a CSRF proof-of-concept payload for a no-defense target where cookies are sent automatically by the browser. The form submits itself when loaded, changing the victim’s email address. PAYLOAD: <form action="https://victim-site.com/my-account/c...

EAEmmanuel Agyarko Ampahfrom-zero-to-cyber.hashnode.devJul 25, 2025 · 1 min read

Payload of the Day #01-Dom XSS in jQuery Sink via location.hash

Tags: [XSS, DOM XSS, Web Security, jQuery, JavaScript] Series: Payload of the Day --- Context: This payload targets a DOM-based XSS vulnerability in a site that uses jQuery’s $() selector and pulls user input directly from location.hash. The vulnerab...

Emmanuel Agyarko Ampah

About

Available for

Emmanuel Agyarko Ampah's blogs

Recently published

Payload of The Day #5 - SQL Injection via XML + WAF Bypass (PostgreSQL Edition)

Payload Of The Day #4 - Blind SQL Injection (Time-Based User Extraction)

Payload #3 - Bypassing File Upload Restrictions with web.config + Custom Extension.

Payload #2 – CSRF Auto-Submit Email Change (No Defense)

Payload of the Day #01-Dom XSS in jQuery Sink via location.hash

Search Hashnode

Emmanuel Agyarko Ampah

About

Available for

Emmanuel Agyarko Ampah's blogs

Recently published

Payload of The Day #5 - SQL Injection via XML + WAF Bypass (PostgreSQL Edition)

Payload Of The Day #4 - Blind SQL Injection (Time-Based User Extraction)

Payload #3 - Bypassing File Upload Restrictions with web.config + Custom Extension.

Payload #2 – CSRF Auto-Submit Email Change (No Defense)

Payload of the Day #01-Dom XSS in jQuery Sink via location.hash