An authenticated user with api.webhooks.write permission can create a webhook whose url field passes FILTER_VALIDATE_URL with file://, dict://, or gopher:// schemes. At dispatch time, curl_init() i...

The regex_replace filter and function are allowlisted in Grav’s Twig content sandbox. When Twig processing in page content is enabled security.twig_content.process_enabled: true, authenticated page...

During a security review of Grav CMS authentication logic, I discovered that the password reset workflow could be manipulated through unsafe URL resolution. This allowed an attacker to influence th...

This is the part two of android pentest, part one documentation is found here. In this document I will show how to intercept android application traffics using burpsuite. In previous post I show...

Mobile application penetration test is similar to web application pentest but it can sometimes be trick to set an environment to perform this action. In this post I will share all necessary steps r...

This is Hackthebox medium Linux machine implemented in NextJS technology with api. This box requires much of enumeration with proper payloads and wordlists in order to get proper responses. I will...

This is hackthebox Windows machine rated hard, with interesting cool way of exploitation start from leaking hashes, password spraying to more privileged users for system account I will demonstrate ...

This is hackthebox Windows machine with outdated installed software which results to remote code code execution which i will use it to get user account and then kernel unpatched issues which i will...

As I was learning Cyber Threat Intelligence I chose Open CTI as demo tool while taking this path, and these were my installation steps which I followed while configuring it. In this document I will...

This is hackthebox easy rated machine designed to show the command injection for the user access and path injection knowledge for the root user. In this box i will show different ways of how to be ...