CRLF is the acronym used to refer to Carriage Return (\r) Line Feed (\n). As one might notice from the symbols in the brackets, “Carriage Return” refers to the end of a line, and “Line Feed” refers to the new line. Hence, both CR and LF are used to denote the ending point of a line. When a user requests content on a website, the server returns the website content along with the HTTP headers. The headers and the contents are separated by a defined combination of CR and LF. It is because of CRLF that a server knows where a new header begins or ends. A Carriage Return Line Feed (CRLF) Injection vulnerability is a type of Server Side Injection which occurs when an attacker inserts the CRLF characters in an input field to deceive the server by making it think that an object has terminated and a new one has begun. This happens when the web application doesn’t sanitize user input for CRLF characters. It has a medium severity rating (P3 according to Bugcrowd’s VRT)....
In this article, we will discuss one of the most seen vulnerabilities in web-based applications, which is — Reflected XSS....
Broken Authentication is in one of the OWASP Top 10 Vulnerabilities. The essence of Broken Authentication is where you (Web Application) allow your users to get into your website by creating a new account and handling it for specific reasons. In Broken Authentication, whenever a user login into its account, a session id is being created, and that session id is allowed to that particular account only. Now if the web application is crafted securely in terms of Authentication, then it is well and good but in case if it is not then the attacker may use several under given techniques....
In this article, we will be understanding one of the types of Cross-Site Scripting in-depth i.e DOM-based XSS. Let’s discuss it one by one as follows....
Zed Attack Proxy is an open-source security software written in Java programming language and released in 2010. It is used to scan web applications and find vulnerabilities in it. It was started as a small project by the Open Web Application Security Project (OWASP) and now it is the most active project maintained by thousands of individuals around the globe. It is available for Linux, Windows, and mac in 29 languages. It can also be used as a proxy server like a burp suite to manipulate the request including the HTTPS request. Daemon mode is also present in it which can later be controlled by REST API....
In this article, we are going to learn about one more attack vector in detail which are very important to learn in this world of lots of Web and Mobile Apps....
Blind XSS is quite similar to stored Cross-Site Scripting attack where the input provided by the attacker is saved or stored by the web server and this stored input is reflected in various other applications which are linked with each other. It only triggers when the attacker’s input is stored by the web server in a database and executed as a malicious script in another part of the application or another application....
Introduction:
Sensitive Data Exposure Vulnerability exists in a web application when it is poorly designed. It allow attacker to apply various security practices and find the sensitive data that is related to particular website. By Sensitive Data Exposure vulnerability, attackers may be able to find sensitive data such as session tokens, authentication credentials, databases etc. By such sensitive data an attacker will be able to exploit the web application and the security of website will be breached....
In this article, we will understand one of the types of Cross-Site Scripting in-depth, i.e. Stored XSS....
The growing demand for the CyberSecurity domain in the tech world has increased the need for cybersecurity professionals in the industry, giving rise to various career opportunities to people interested in making their career in the cybersecurity sphere. However, as people are still not much aware of the career options in the cybersecurity field, there is too much confusion amongst the people while planning to start a career in it. Though, out of many professions in this particular sector, Cybersecurity Consultant is one of the most exciting and challenging jobs for the aspirants....
Subdomain enumeration is the process of finding valid (resolvable) subdomains for one or more domain(s). The general system is to use a dictionary of common names, trying to resolve them. These detected subdomains can reveal crucial information about the target, which might not be present in the main domain. Massc tool is a Nodejs language-based tool used to find the subdomains with 200 OK Status code. This tool is an open-source tool and free to use. Massc tool brute-forces the words from the default wordlists and sends the request to the target domain web server, if the webserver serves the request with the standard response, then the tool displays the subdomain with the 200 OK status code else there might be the absence of the specified subdomain the target domain server....
