Pwning XML
Advanced file access with CDATA We initially discuss XML External Entities (XXE) exploits in XML External Entities, Retrieving Files, however, the examples provided don’t account ...
one2bla.me
Last 10 notes on one2bla.me
Latest posts
Reversing Java web applications
Useful configuration files Java web applications map API routes to Java servlets, as described in our Source code analysis methodology notes. The default location Java web applications store their Java servlet mappings is: web.xml No guaranteed which folder this can typically be found in, but be on the lookout for this configuration file in a Java web application.
Reversing Python web applications
Debugging Python web applications Usually, Python web applications aren’t distributed in some sort of “compiled” release format - but they can be. We’ll discuss reverse engineering compiled Python applications if we need to, but for now we’ll just talk about about plaintext web applications.
Server-side request forgery
Server-side request forgery (SSRF) is a scenario in which the attacker can coerce the vulnerable server to make requests to other hosts on the attacker’s behalf ...
Server-side template injection
Server-side template injection (SSTI) is a vulnerability where a server uses an attacker’s input to render a template but fails to sanitize the content provided, enabling the attacker ...
Source code analysis methodology
Approaches Two central approaches are pretty useful for discovering bugs in a web application during source code analysis: a top-down approach and a bottom-up approach ...
Source code recovery
If we get our hands on the compiled byte code for web technologies like C# and Java, we can use various tools to recover the original source code that convert the application’s byte code ...
SQL enumeration
Web applications have to store user data so that, when you login, they can restore your session, settings, etc. Where else would they hold this information but a relational database like SQL? Using SQL, however, increases the attack surface for a web application, and allows us to do a bunch of nasty things once we can inject SQL queries and commands.
SQL injection
In this section, we’ll cover some common ways of discovering SQL injection vulnerabilities in a web application. First, what is SQL injection? It’s when arbitrary input is used by an attacker to construct the remainder of a SQL query by the web application before executing the query on the web app’s underlying database.
Web app enumeration
Discovering running services After using reconnaissance to define our web application target’s presence on the internet, we aim to enumerate the target’s services ...