#web

• 2022-01-20 Hacker techniques developers should know in 2022 My Kode24 guest post walking developers through four attack classes worth understanding: SQL injection, XXE, XSS, and SSRF, with the defensive takeaway for each.
• 2016-08-19 An Azure zero-day XSS with sandbox escape Chaining a command injection into a stored XSS that jumps from a compromised SaaS site to the Azure administrator through the Kudu console.
• 2014-12-04 Finding zero-day XSS through document metadata Embedding XSS payloads in EXIF and document metadata, and using the technique to find zero-days in image-sharing sites and WordPress.
• 2012-10-06 XSS explained The three ways to deliver a Cross-Site Scripting payload, the attack vectors that make it dangerous, and a short history of XSS in the wild.
• 2012-05-11 Enumeration with sqlmap Using sqlmap to enumerate databases through a SQL injection, what enumeration means in a pen test, and how the attack looks in the server logs.

all tags →