Tag feed

DOM-Based XSS in DVWA

5d ago · 14 min read · Introduction This post examines a DOM-based cross-site scripting (XSS) vulnerability in the Damn Vulnerable Web Application (DVWA) and demonstrates how it can be exploited to achieve client-side code

WBWiktoria Blomgren Strandbergpentesting-dvwa.hashnode.dev

JavaScript Attacks in DVWA

Mar 26 · 20 min read · 1 Introduction In this post, the JavaScript Attacks vulnerability in the Damn Vulnerable Web Application (DVWA) is described. The objective for attacks on all levels is to analyse and manipulate the J

Stored XSS in DVWA

Mar 25 · 12 min read · Introduction This post examines a Stored Cross-Site Scripting (XSS) vulnerability in the Damn Vulnerable Web Application (DVWA), and demonstrates how it can be used to achieve persistent client-side c

WBWiktoria Blomgren Strandbergpentesting-dvwa.hashnode.dev

API Security in DVWA

Mar 21 · 24 min read · 1 Introduction In this post, the API Security vulnerability in the Damn Vulnerable Web Application (DVWA) is described. The objective for attacks across all security levels is to exploit weaknesses in

Reflected XSS in DVWA

Mar 19 · 14 min read · Introduction This post demonstrates how a reflected Cross-Site Scripting (XSS) vulnerability in the Damn Vulnerable Web Application (DVWA) can be exploited to execute malicious client-side scripts in

WBWiktoria Blomgren Strandbergpentesting-dvwa.hashnode.dev

CSP Bypass in DVWA

Mar 14 · 13 min read · 1 Introduction In this post, the Content Security Policy (CSP) Bypass vulnerability in the Damn Vulnerable Web Application (DVWA) is described. The objective for attacks on all levels is to bypass the

File Upload in DVWA

Mar 12 · 15 min read · Introduction This post demonstrates how a file upload vulnerability in the Damn Vulnerable Web Application (DVWA) can be exploited to achieve remote code execution. The objective of the attack is to u

MBMokshan Basurumokshan.hashnode.dev

Beyond the Scanner: Analyzing Infrastructure & Logic Vulnerabilities in SaaS APIs

Mar 11 · 6 min read · Executive summary During a security assessment of an enterprise-grade package library, I identified a multi-stage attack chain composed of three logic and infrastructure flaws: HTTP Parameter Pollutio

WBWiktoria Blomgren Strandbergpentesting-dvwa.hashnode.dev

Authorisation Bypass in DVWA

Mar 8 · 12 min read · 1 Introduction In this post, the Authorisation Bypass vulnerability in the Damn Vulnerable Web Application (DVWA) is described. The objective for attacks on all levels is to identify any areas where a

Brute Force in DVWA

Mar 8 · 16 min read · Introduction This post explores the brute-force vulnerability in the Damn Vulnerable Web Application (DVWA). The objective of the attack is to gain unauthorised access to the application by discoverin