PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Login Pages

labs.cognisys.group | blog | #sql-injection | #web-security | #authentication | #pentest | #credential-stuffing | #bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A walkthrough of common login page bypass techniques—SQL injection, response manipulation, forced browsing, default credentials and credential stuffing—and how defenders should counter them.
Published
Collected

Related coverage

blog · blog.trailofbits.com
SAML: A fractal of bad design
Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
blog · xbow.com
Introducing Autonomous Exposure Management: Offensive Security at Enterprise Scale
XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.
blog · about.gitlab.com
PHP2Shell: GitLab helps find and remediate critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Learn which PHP versions fix them and how to check your projects.
blog · yeswehack.com
Web application firewall bypass
Bypassing web application firewalls after a flaw is found: abusing regex and blacklist weaknesses, normalisation quirks and frontend/backend filter collisions to slip payloads past WAFs.
blog · bugcrowd.com
State of Retail Cybersecurity: Saying IDONT to IDOR this Holiday Season
Ahead of the holiday shopping season, Bugcrowd surveys retail cybersecurity: credential stuffing hits 80-90% of e-commerce logins, and retail crowdsourced programs grew 137% year over year.
blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
Back