PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

yeswehack.com | blog | #pentesting | #php | #docker | #debugging | #white-box | #xdebug
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guide to white-box pentesting of PHP apps with Xdebug: setting up Docker and VS Code debugging to find file inclusion, regex errors and unsafe uploads, and craft new payloads.
Published
Collected

Related coverage

blog · yeswehack.com
White-box penetration testing: How to debug for JavaScript vulnerabilities
Guide to white-box pentesting of JavaScript apps in Docker: debugging in VS Code to trace payloads, plus common flaws — prototype pollution (CWE-1321), type confusion and XSS.
blog · yeswehack.com
White-box penetration testing: Debugging for Python vulnerabilities
Guide to white-box pentesting of Python apps in Docker: debugging in VS Code to track payloads, covering prototype pollution, template injection (CWE-1336) and path traversal.
blog · yeswehack.com
Why pentests cause security debt
New features ship, dependencies update, new APIs are added… and all the while, despite your pentest program, security debt mounts up.
blog · yeswehack.com
Pentests are dead. Long live pentests.
Traditional pentests have created a cottage industry of painful admin. So what needs to change?
blog · yeswehack.com
Top 5 hacking tools for white-box pentesting
Top 5 white-box pentesting tools: VS Code and its debugger, SonarQube for SAST, AFL++ for fuzzing and DevDocs — plus open-source targets paying bounties up to €10,000.
blog · yeswehack.com
PwnMachine: quick update about fix and new features
An update on PwnMachine, YesWeHack's self-hosted hunting environment: the web interface now handles file upload/download from any volume, and custom Docker images import from a Git repository.
Back