Lab link. This lab has a “Check stock” feature that parses XML input, but does not display any unexpected values, and blocks requests containing regular external entities. To solve the lab, use a parameter entity to make the XML parser…
Lab link. This lab has a “Check stock” feature that parses XML input but does not display the result. You can detect the blind XXE vulnerability by triggering out-of-band interactions with an external domain. To solve the lab, use an…
Lab link. If the application has taken precautions for the file extension, there are several ways to bypass this precaution. In this lab, we use the null byte method to bypass the file extension blocking. In Requesat’s response, we see…
Lab link. The application has used a blacklist for security, but if we upload the .htaccess file, we can allow any file extension we want on the server. The file with the .php extension does not work. We make changes…
Lab link. In some systems, there may be more than one vulnerability, or we may continue with a different vulnerability in the continuation of one vulnerability. In this lab, we can upload files thanks to path traversal. In the lab,…
Lab link. Blind SSRF occurs when an application can be encouraged to send a back-end HTTP request to a given URL, but the response from the back-end request is not returned in the application’s front-end response. Using Burp Collaborator we…
Lab link. We can perform SSRF attack with parameters vulnerable to open redirection. Our path redirecting request is “GET /product/nextProduct?currentProductId=4&path=”. We edit this request according to our payload and send it with the stockApi used in the check stock process.
Lab link. Another SSRF measure is Whitelist-Based. The application only allows entries that match a whitelist. The filter can search for a match inside the input. We bypass this filter by exploiting inconsistencies in URL parsing. We try to find…
Lab link. Blacklist-based management can be used as a precaution against SSRF attacks. Some applications can block IP and keywords such as localhost, admin, or 127[.]0[.]0[.]0[.]1. This method can be bypassed. We navigate the application and find where an HTTP…
Lab link. First, we check if redirect_uri has a defense against path traversal. Browse other pages. Requests are followed in the comments section of the blog page. window.location.href and postMessage() are used in the comment section. window.location.href contains the current…