Freaks City

SQL Injection with Advanced Bypass Techniques This section details a classic SQL injection vulnerability, requiring a series of discovery steps and an advanced bypass method to retrieve sensitive information. Vulnerability Identification Initial reconnaissance revealed the presence of a SQL injection vulnerability. Inputting a single quote (1') ...

Hello-javasec Code Audit Environment: https://github.com/j3ers3/Hello-Java-Sec Configure the database and start the project directly. This project is built with Spring Boot. Swagger and Actuator Unauthenticated Access When examining dependencies, both Swagger and Actuator were present, so I reviewed their configurations. Swagger had no securit ...

Web Security Fundamentals 1. SQL Injection Types and Prevention SQL injection occurs when untrusted data is concatenated into SQL queries without proper validation, allowing attackers to manipulate data base operations. Common types include: character-based, numeric, boolean, error-based, time-based, union-based, stacked queries, wide-byte, and ...

The challenge presents a web application with login and registration functionality. The objective is to retrieve the hidden flag from the database. Initial Exploration Upon accessing the application, we notice registration and login options. Attempting to register with the username "admin" reveals that the account already exists, sugg ...

Penetration Testing Methodology Standard Penetration Testing Process Initial project preparation and scope definition Information gathering: WHOIS lookup, source IP identification, virtual host detection, C segment scanning, server system version, container version, application version, database type, subdomain enumeration, firewall identifica ...

Understanding SQL Injection SQL injection is a prevalent form of cyber attack that exploits vulnerabilities in database query construction. It typical occurs when user input is directly concatenated into SQL queries without proper validation or sanitization, allowing attackers to manipulate SQL logic or execute arbitrary commands. Example of SQ ...

File Inclusion and Upload Vulnerabilities File inclusion vulnerabilities occur when a web application dynamically includes files based on user input without proper validation, allowing attackers to include malicious files. Modern server-side languages like PHP (since version 5.2.0) often disable remote file inclusion by default, making Local Fi ...

The login form itself remains unresponsive to basic authentication attempts. After registering an arbitrary account and signing in, the application redirects to a path containing a title parameter and exposes a password-change feature. Attempting to inject inside the password-reset interface produces no discernible output, indicating the vulner ...

Character encoding represents the fundamental mechanism for translating characters into byte sequences within computing environments. Different databases and systems may utilize varying encoding schemes such as UTF-8, ISO-8859-1 (Latin-1), and GBK. When exploiting SQL injection vulnerabilities, attackers can leverage these encoding differences ...

Interacting with MySQL using Python MySQL utilizes a client-server architecture. While it provides its own client (mysql.exe), Python applications can act as clients to interact with the MySQL server using librarise like pymysql. Workflow: Establish a connection (host, port, credentials, database, charset). Construct SQL statements within Pyth ...