Websecurity

Introduction I applied for the HackingAPIsWithDami challenge, and in the first week we were given some courses and the Vulnerable RESTaurant API Lab to test our hands on skills. The lab and installation guid can be found on here: Vulnerable RESTaurant API. NB: I hosted mine locally on ubuntu_server:8080, so the base URL in this write-up may differ from yours. In this write-up, I will be exploiting the API step by step and mapping each vulnerability to the OWASP API Top 10, including practical remediation strategies. ...

Server Side Request Forgery(SSRF) is a vulnerability that allows attackers to send requests on behalf of a server, During an SSRF, attackers forge the request signatures of the vulnerable server, allowing them to assume a privileged position on a network, bypass firewall controls, and gain access to internal services. In this writeup, we will exxplore how to find some basic SSRFs and also how to bypass some SSRF protections. LAB 1: Basic SSRF against the local server Objective: This lab has a stock check feature which fetches data from an internal system. To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin. ...

Introduction Good day hackers, welcome to my blog again. In this writeup i will take you through how i was able to exploit an intentional Vulnerable Bank Application by Ghost St. Badmus, One of the best Application Security Engineers in the industry. You can find the Lab here: Vulnerable Bank Application 🏦 or vulnbank.org. Authentication & Authorization Vulnerabilities SQL Injection in login The first thing we will see when we access the application is the Login/Register page,we will try logging in with a simple SQLI payload to see if the application is vulnerable to SQLI. After using ‘or 1=1- - as the username and pass as password,we were logged in as the admin. ...

Platform: TryHackMe Link: Stickershop Level: Easy To read the flag in this very simple room, we must take advantage of a Cross-Site Scripting vulnerability. Scanning Using nmap to scan the target: nmap -sV -sC Target_IP -OG The_Sticker_Shop Results Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-30 19:58 GMT Nmap scan report for 10.10.97.238 Host is up (0.17s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 b2:54:8c:e2:d7:67:ab:8f:90:b3:6f:52:c2:73:37:69 (RSA) | 256 14:29:ec:36:95:e5:64:49:39:3f:b4:ec:ca:5f:ee:78 (ECDSA) |_ 256 19:eb:1f:c9:67:92:01:61:0c:14:fe:71:4b:0d:50:40 (ED25519) 8080/tcp open http Werkzeug httpd 3.0.1 (Python 3.8.10) |_http-server-header: Werkzeug/3.0.1 Python/3.8.10 |_http-title: Cat Sticker Shop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.08 seconds we found two open ports; 22(SSH) and 8080(http) ...