-
**Context**
After the post in medium about the WordPress and serialize bug that can be read here https://medium.com/websec/wordpress-and-recursive-unserialize-5518b124b23b the fix has been applied…
widoz updated
5 years ago
-
The CSRFProtectionFilter uses the `X-Requested-By` header, which is fine and meets proper CSRF protection criteria. However- the [OWASP cheat sheet](https://www.owasp.org/index.php/Cross-Site_Request_…
-
攻擊者學號:B10732002 @isgordon458
被攻擊者學號與網址:B10830027 @mandy900619 https://demo.mandy.social/
漏洞類型:(XSS)
漏洞描述
在上傳貼文處有 XSS inejection
PoC
登入網頁後,在上傳貼文處新增一則貼文,其內容為
```
alert(1)
```
![imag…
-
Given the following web-platform-tests `mimesniff/test.py`:
```python
def main(request, response):
response.add_required_headers = False
response.writer.write_header("X-Content-Type-Option…
-
As sysadmin for opencaching.ro I received a report from Open Bug Bounty about a discovered vulnerability on the site.
Cited report can be found here: https://www.openbugbounty.org/reports/1930692/
D…
-
https://websec.space/2022/02/04/web%E5%AE%89%E5%85%A8%E4%B9%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/
web安全之命令执行无聊时间,写点最近一直研究的命令执行的一些心得与总结。 希望做成一个类似字典类型的文档。 成因通常情况下,在开发者使用一些执行命令函数且未对用户输入的数据进行安全检查时,可以…
-
```
Instead of having an issue i want to give you some new ideas.
As u probably know there are many ways of file inclusion. Though not everyone
knows some neat tricks if %00 isn't working. A few of t…
-
```
Instead of having an issue i want to give you some new ideas.
As u probably know there are many ways of file inclusion. Though not everyone
knows some neat tricks if %00 isn't working. A few of t…
-
I changed wlan0mon to wlan1mon, after running I getting this:
```
PHY Interface Driver Chipset
phy0 p2p0 ?????? Not pci, usb, or sdio
phy0 wlan0 …
-
https://websec.space/2022/06/23/ciscn%E5%8D%8E%E4%B8%9C%E5%8C%97/
CISCN华东北赛区wp国赛已经结束了好几天了,在国赛后,我从宿舍搬走了所有的东西,告别了生活两年的校区。 在这里抒发一下对于国赛的感受,这参加CTF比赛的两年时间,从懵懵懂懂,到后来慢慢领悟,看到一些乱象,我选择无视,而这次区域赛是让我对CTF最失望的一次。当…