Two Recent Grafana Security Issues Every Security Team Should Understand

Exploring HTTP Verb Tampering and Broken Access Control

Hello, long time no blog. It has certainly been a while but I am still doing penetration testing. Some say I am wasting my potential by not…

Introduction

In this challenge, a seemingly harmless web server exposed a configuration file containing SSH credentials. Those credentials granted…

How a 4-character file name prefix turned a resume upload into a persistent backdoor into a Ukrainian bank’s HR panel — and why this class…

Exploiting an Unchecked postMessage Listener — DOM XSS Using Web Messages (PortSwigger Academy)

After testing my website’s security, I found evidence of XSS and SQL injection.

Introduction

firstly we explain what of the Insecure direct object references???