In this article will see how I can able to execute XSS payload via chatbot In the previous article, I explained about the simple Stored XSS in Cloudflare protected application. In this article will see how I can able to execute the XSS via a chatbot in the Cloudflare-protected WebApp. …

In my previous article, I explained the Cloudflare WAF bypass with a simple payload. In this article, I used the same payload to bypass the WAF to get the stored XSS. This target is India's leading EdTech Startup incubated by IIT-M & IIM-A, providing highly-effective & finest learning solutions through…

Hello Folks, in this article let’s see how I got the PHP Info file disclosed via Blind SSRF. Let’s get Started !! 😉 Firstly, I started with recon as usual. I found that the application is using Ubuntu Linux with apache running webservers.

Sometimes simple payloads help to bypass the WAF filter. Hello Folks, in this article let’s see how I executed the XSS on Cloudflare WAF Protected web app. Let’s get Started !! 😉 This is one of my old targets, If I want to spend some time on pen-testing, I usually…

I already explained in my previous article → IDOR is everywhere. IDOR is easy to exploit and doesn’t require much effort to find. Hello Folks, In this article, I would like to explain the IDOR on my own university application. Let’s get Started !! 😉 I’m studying for my Post…

If a developer doesn’t enforce the character limit on the user-supplied field may bring the application server down, due to the unhandled malicious request. Hello folks, In this article will discuss the Application level DDOS which I performed during my pen-testing. What is Application DDOS? Application DDoS attacks are distributed…

Privilege Escalation, IDOR, and Access Control bugs are my favorite nowadays, I found them everywhere 🤷‍♂️ Hello Folks, In this article, I will explain the IDOR on Acko. Today’s application belongs to one of the “private-sector general insurance companies in India called Acko”. I saw someone post about their “Hall…

Yes, true! I don’t know why developers will do these kinds of mistakes while writing code 🤷‍♂️ anyone who analyses the flow can break this. Hello Folks, In this blog, I want to discuss how developers will make mistakes while writing the code, No No while copy paste from StackOverflow…

Just replaced my email ID with the victim's email ID and Boom !! Hello Folks, in this article I will explain one of my account takeover reports. Let's get Started !! 😉 I was hunting on the same program where I found “20K INR — IDOR to Account Takeover 🔥🔥” …