Get account takeover via IDOR form JWT

Today I’m gonna explain how I got IDOR and exploit it to make account takeover.

Source

#web #AppSec

UP-SOLVING Combination Lock

I'm gonna explaining how i solved the Combination Lock problem solving

Source
YouTube

#useful #fun

Bypassing 403s like a PRO! ($2,100): Broken Access control

This article highlights my way of dealing with 403s and how I managed to get a P1 in minutes!

Source
403 Bypasser Burp extension

#web

PDF - JWT Attacks (intro , attacks , Real world scenario and Mitigation)

Nuclei Vuln Scanner

Fast and customisable vulnerability scanner based on simple YAML based DSL.

Nuclei is used to send requests across targets based on a template, leading to zero false positives and providing fast scanning on a large number of hosts. Nuclei offers scanning for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless etc. With powerful and flexible templating, Nuclei can be used to model all kinds of security checks.

GitHub

#tools

Oh.. My God😄

#fun

Azure AD Security Config Analyzer (AADSCA)

We decided to take alternative approach for chapter 6 and we are not covering possible Azure AD attack path. This time, the focus is on on proactive side, how organizations can monitor and strengthen Azure AD's security posture. For this purpose we created 'Azure AD Security Config Analyzer' aka 'AADSCA' solution.

GitHub
Official page

#windows

Какой вопрос - такой и ответ :):)

#fun

Email Incident Response

Email security incidents pose a high risk to a business & organization. The risk includes phishing, business email compromise (BEC) unauthorized access etc. This article describes some unique incident actions for email compromise cases.

Source

#forensic

Hack by HTML

HTML can be used for faking malicious phishing link, bypassing browser history etc. Here is my new article 'Hack by HTML' on it.

Source

#pentest #web