Recent content on Gx1 Website
Have you ever thought that ChatGPT can be used to create awesome decision diagrams? You have a sort of text like this: Step 1: What is the primary goal of your model? Classification / Prediction (e.g., categorizing images, predicting a label): Proceed to Step 2 Regression (e.g., predicting continuous values): Proceed to Step 2 Clustering (e.g., grouping similar data): Use K-Means, DBSCAN, or…
Test driven development methodology is aimed at improving software modularity by using an approach based on writing tests before writing program code. Methodology principle The principle is very simple: when you develop you always try to test with example data, which is taken and printed. You use console.log until you solve the problem. Imagine that you write an operations.js library that has…
Have you ever studied Docker? If you are a passionate about web hacking, study it! In this Post I am going to persuade you that using Docker to study web vulnerabilities is a good thing! If you want to understand more about this post, please follow Docker Documentation How do you find vulnerabilities? There are several techniques: Fuzzing Studying source code Run and debug source code Regardless…
This morning I woke up with an email from GitHub that seemed pretty accurate It seemed a mail from GitHub, and at the first glance I did not realize that it was a phishing. However, (even when I recover from my sleep), I analyzed it better. Discover the phishing attempt The “here” link pointed to: https://githubtalentcommunity.githubcareers.online/ # THIS IS MALICIOUS There are difference…
I am Gaetano Perrone, a compiuter science passionate about software development, cybersecurity, and research. 💻 Development skills I really love developing software, and I usually realize security tools for my work and researches. I have developed Docker Security Playground, a microservices-based framework for the study of Network Security and Penetration Test techniques. Known programming…
When trying to find a methodology for performing a Penetration Test against a Web Application (meaning those that are accessed using a browser to communicate with a web browser), one should keep in mind that Hackers’ activities to find new vulnerabilities always involve a great deal of creativity. It is possible, though, to explore all the regions of the application’s attack surface and gain some…
The problem of attacks on Web applications today is highly critical. To understand it, simply observe the following diagram, which shows the number of Kaspersky web antivirus detections per second: The average number of threats detected is about 200 per second! (You can see the threats in real time directly here.) But what can we do to defend ourselves against attacks? In this whitepaper we…
A year ago I discovered a stored XSS in Contact Form Entries plugin. It is an interesting case of Cross-Site Scripting vulnerability in headers. Introduction CRM Form Entries is a plugin that automatically saves form submissions from several WordPress forms: Database for Contact Form 7, WPforms, Elementor forms After a long time I finally received a CVE for this discovery that you can find on the…
After the post from last week about CVE-2021-25080 I received another CVE from a similar work on the same plugin. In this case, I found multiple XSS in Contact Entries Plugin: let’s dive into the vulnerability! Introduction CRM Form Entries is a plugin that automatically saves form submissions from several WordPress forms: Database for Contact Form 7, WPforms, Elementor forms Setup environment I…