_Y000_ – Medium

Published in Nerd For Tech

·Pinned

XSS from 0! All you need to know!

My name is Luis Madero (_Y000! _) I am a computer systems engineer, bug hunter and above all a lover of web security, in this writing I would like to touch on the topic of xss injections from a theoretical point of view until I see some examples of injections…

Xss Attack

9 min read

Published in InfoSec Write-ups

·May 31, 2021

Understanding XPath injection with practical examples.

In this writing you will learn about XPath injections and I will try to be as clear as possible. What is an xpath injection? XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in…

Xpath

6 min read

May 31, 2021

Entendiendo la inyección XPath con ejemplos prácticos.

En este escrito aprenderás acerca de inyecciones Xpath e intentaré ser lo mas claro posible. Qué es una inyección xpath? XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears…

Xpath

6 min read

May 28, 2021

Inyección SQL divertida 2 — MSSQL

En esta ocasión me gustaría relatar paso a paso otra de las inyecciones que mas me han gustado Se trata de un sitio que me llegó de parte de un colega para testear juntos! El parametro en donde se hace el ataque sirve para mostrar un documento en PDF y…

Sql

5 min read

Published in InfoSec Write-ups

·May 28, 2021

Fun SQL Injection 2 — MSSQL

On this occasion I would like to relate step by step another of the injections that I liked the most. This is a site that came to me from a colleague to test together! The parameter where the attack is made is used to display a PDF document and it…

Sql Server

5 min read

Published in InfoSec Write-ups

·Apr 19, 2021

GOOGLE HACKING / DORKING

What is dorking? Google hacking or Dorking is nothing more than a way of looking for things a little more specialized, by the name “Google Hacking” you can give the impression that it is only used in google, but that is not correct. Dorking is nothing more than an advanced search where we…

Google

10 min read

Published in Nerd For Tech

·Apr 19, 2021

Some tips for SQL injections

In this writing I will leave some tips for sql injections, where I will try to explain only specific points. First we will talk about how to find a vulnerable page thanks to google hacking. Dorks

Sql Injection

4 min read

Apr 19, 2021

Algunos tips para inyecciones SQL

En este escrito dejaré algunos tips para inyecciones sql, en donde trataré de explicar solamente puntos específicos. Primero hablaremos de como encontrar una página vulnerable gracias a google hacking. Dorks

Sql Injection

4 min read

Published in InfoSec Write-ups

·Apr 16, 2021

Fun sql injection — mod_security bypass

In this writing I would like to show you a somewhat peculiar case with which I came across testing a website. This is an sql injection where I could bypass the “mod_security” waf. When I start the sql injection test I realize that the website is using that waf. We…

Sql Injection

4 min read

Apr 16, 2021

Inyección sql divertida— bypass mod_security

En este escrito me gustaría enseñarles un caso algo peculiar con el que me encontré testeando un sitio web. Se trata de una inyección sql en donde pude bypassear el waf “mod_security”. Al iniciar el el testeo de inyección sql me doy cuenta que el sitio web esta usando ese…

Sql Injection

4 min read

Inyección sql divertida— bypass mod_security