Freaks City

Hello-javasec Code Audit Environment: https://github.com/j3ers3/Hello-Java-Sec Configure the database and start the project directly. This project is built with Spring Boot. Swagger and Actuator Unauthenticated Access When examining dependencies, both Swagger and Actuator were present, so I reviewed their configurations. Swagger had no securit ...

SQL Injection Fundamentals Introduction to Database Query Manipulation Structured Query Language enables interaction with relational database systems. This section demonstrates how improperly constructed quereis can be exploited to bypass security controls and access unauthorized data. Basic Retrieval Operations Consider a personnel database ta ...

Cross-Site Scripting (XSS) Core Mechanism XSS vulnerabilities occur when applications trust user-submitted data without proper sanitization. The server processes user input, converts it to HTML elements, and delivers it to clients where malicious scripts execute. Characteristics Stealthy execution with no visible interface Theft of sensitive u ...

This article covers foundational web concepts essential for understanding cross-site scripting (XSS) vulnerabilities — focusing on HTTP mechanics, client-side state management, and browser scripting behavior. HTTP Communication Essentials Request Methods GET: Retrieves resources without side effects. Parameters appear in the URL query string a ...

Framework Initialization and ConfigurationThe Browser Exploitation Framework (BeEF) is a penetration testing tool that focuses on web browser vectors. It allows security professionals to assess the security posture of a client-side environment by hooking browsers and launching module-based attacks. The framework is typically written in Ruby and ...

Penetration Testing Methodology Standard Penetration Testing Process Initial project preparation and scope definition Information gathering: WHOIS lookup, source IP identification, virtual host detection, C segment scanning, server system version, container version, application version, database type, subdomain enumeration, firewall identifica ...

Static code analysis tools like Fortify often flag the use of jQuery.append() when handling dynamic data, flagging potential Cross-Site Scripting (XSS) vulnerabilities. To resolve these security warnings without altering the application's core functionality, developers can implement specific remediation strategies.1. Utilizing Native DOM Proper ...