Hi, My name is Hashar Mujahid. I am a security researcher and a penetration testing student. This is the first blog of the API SECURITY series where we will learn about some common security vulnerabilities that APIs are prone to. We can not understand object-level authorization until we have a…

Hi, My name is Hashar Mujahid and today we are going to solve a medium box named BroScience on hackthebox. Let’s start with the TCP nmap scan. PORTSCAN: hax-13@ZARB:~/Documents/ctfs/htb/medium/Broscience-10.10.11.195$ sudo nmap -sC -sV -oA nmap/tcp -p- --min-rate 1500 10.10.11.195…

This is the writeup of the soccer machine on hackthebox. ENUMERATION: PORT SCAN: ┌──(kali㉿kali)-[~/Desktop/ctfs/Soccer-htb] └─$ cat nmap/nmap-scan # Nmap 7.93 scan initiated Thu Jan 5 05:47:19 2023 as: nmap -sC -sV -p- --min-rate 1500 -oN nmap/nmap-scan soccer.htb Nmap scan report for soccer.htb (10.10.11.194) Host is up (0.15s latency). Not shown: 65532 closed tcp ports…

Hi! My name is Hashar Mujahid and Today we are going to solve a room from vulnhub which is listed as OSWE like machine by TJ-Null. ENUMERATION: HOST DISCOVERY: We will start with discovering potential targets on our network. We can use multiple tools for this purpose like netdiscover, fping or nmap. fping…

Hi! My name is Hashar Mujahid and today we will see how Kerberos authentication works. What is Kerberos? Kerberos is an authentication protocol that Microsoft widely implements in their Active Directory Services. It allows users to access services or data over an untrusted network by proving their identity with the help of tickets…

Hi! My name is Hashar Mujahid and today we will talk about Cross-origin resource sharing (CORS). — Let’s start from the basics. Shall we? To understand CORS first we need to understand what is SOP (Same Origin Policy). WHAT IS SOP? The same origin Policy is a security mechanism That restricts how a resource loaded from one origin (domain) can interact with a resource from another origin(domain). It restricts malicious…

Hi! My name is Hashar Mujahid, and today we will continue to discuss what HTTP request smuggling vulnerabilities are and how we can exploit them. Hi, today we’re going to talk about how we can bypass the front-end security measures using HTTP request smuggling methods. If you don't know what…

Hi! My name is Hashar Mujahid, and today we will continue to discuss what HTTP request smuggling vulnerabilities are and how we can exploit them. If you want to learn what HTTP REQUEST SMUGGLING is, I would recommend reading Part 1 of this series. HTTP request smuggling Explained and Exploited Part 0x1 Hi! My name is Hashar Mujahid and today we will sneak a peek into Request Smuggling Vulnerabilities.infosecwriteups.com

Hi! My name is Hashar Mujahid and today we will sneak a peek into Request Smuggling Vulnerabilities. So let’s look into what HTTP request smuggling is! What is HTTP request smuggling? HTTP request smuggling is an exploitation technique in which a malicious request is inserted inside an original request, which is then processed by the…