My methodology for finding subdomains. I hope it helps!

https://medium.com/@marduk.i.am/recon-methodology-subdomain-enumeration-0e0493001a03

#bugbountytips #bugbounty #CyberSecurity #resonnaissance #EthicalHacking

Latest lab write-up. Came out a bit long but very informative.

https://medium.com/@marduk.i.am/blind-sql-injection-with-conditional-responses-46ee90b5f2c0

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #Portswigger

It's been a while but here is another SQLi lab. Enjoy!

https://medium.com/@marduk.i.am/sql-injection-union-attack-retrieving-multiple-values-in-a-single-column-d6c6d91be74d

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

Last in a series of 3 labs. Enjoy

https://medium.com/@marduk.i.am/sql-injection-union-attack-retrieving-data-from-other-tables-38f471813c57

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

Second in a series of 3 labs.

https://medium.com/@marduk.i.am/sql-injection-union-attack-finding-a-column-containing-text-ee28ff48eb30

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

First in a series of 3 labs.

https://medium.com/@marduk.i.am/sql-injection-union-attack-determining-the-number-of-columns-returned-by-the-query-a740b76989fe

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

Latest SQLi lab write-up. Hope you find it useful!

https://medium.com/@marduk.i.am/sql-injection-attack-listing-the-database-contents-on-oracle-3be23e33a43d

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

Latest lab write-up. Hope it's useful!

https://medium.com/@marduk.i.am/sql-injection-attack-listing-the-database-contents-on-non-oracle-databases-825485566585

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

I just published SQL Injection Attack, Querying the Database Type and Version on MySQL and Microsoft https://link.medium.com/hHxIw42EMLb

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

It's been a while but here is the latest write-up!

https://medium.com/@marduk.i.am/sql-injection-attack-querying-the-database-type-and-version-on-oracle-fcbd7a064b89

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

Morning coffee view

Quickie but a goodie.

https://medium.com/@marduk.i.am/sql-injection-vulnerability-allowing-login-bypass-53155648f198

#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs

So, Microsoft is silently installing Copilot onto Windows Server 2022 systems and this is a disaster.

How can you push a tool that siphons data to a third party onto a security-critical system?

What privileges does it have upon install? Who thought this is a good idea? And most importantly, who needs this?

#infosec #security #openai #microsoft #windowsserver #copilot

There is something potentially huge popping up now. Has to do with a compromise at business intelligence vendor Sisense. I'm hearing this is a supply chain attack affecting many millions of credentials and hundreds of tenants. This is a message the Sisense CISO just sent to customers.

Last of the 'apprentice' level labs. Next up. Expert!

https://medium.com/@marduk.i.am/exploiting-xss-to-perform-csrf-275288910459

#BugBounty #bugbountytips #CrossSiteScripting #informationsecurity #XSS #PortswiggerLabs #storedxss

XSS, CSRF, and credential stealing! Really fun!

https://medium.com/@marduk.i.am/exploiting-cross-site-scripting-to-capture-passwords-b2cda84698b0

#BugBounty #bugbountytips #CrossSiteScripting #informationsecurity #XSS #PortswiggerLabs

XSS, CSRF, and session hijacking!

https://medium.com/@marduk.i.am/exploiting-cross-site-scripting-to-steal-cookies-3d14c8b42fae

#BugBounty #bugbountytips #CrossSiteScripting #informationsecurity #XSS #PortswiggerLabs

“I made a decision. I want to learn Go”

Replies I hoped for: “Cool! I won’t question your reasons out of respect and here are some links/books/code that helped me. Enjoy your journey!”

Replies I got: “you should learn Rust. Go sucks.”

Le sigh, people. When I share something I am looking for help and support. Not attacks.

(I’ll stick with Go. Just as I had an Atari 400 and not a Commodore 64 like almost all ;)

Learning about template literals!

https://medium.com/@marduk.i.am/reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-backslash-and-d5cf41f25b02

#BugBounty #bugbountytips #CrossSiteScripting #informationsecurity #XSS #PortswiggerLabs #reflectedxss

My 20th cross-site scripting write-up!!

https://medium.com/@marduk.i.am/stored-xss-into-onclick-event-with-angle-brackets-and-double-quotes-html-encoded-and-single-002848f8deb1

#BugBounty #bugbountytips #CrossSiteScripting #informationsecurity #XSS #PortswiggerLabs #storedxss