Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy

netspi.com | blog | #pentesting | #fuzzing | #web-security | #owasp | #csrf | #burp-proxy

Summary

Since its formal recognition by the security community in 2007 on the OWASP Top Ten list, Cross Site Request Forgery (CSRF) has stepped out of the shadows and joined the ranks of vulnerability all-stars like Cross Site Scripting (XSS) and SQL injection.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Exploiting XPath Injection Weaknesses
A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.
blog · netspi.com
Macros Demystified
A three-part video series demystifies Burp Suite macros: capturing dynamic values like CSRF tokens, chaining sessions, and automating complex multi-request scenarios, with practice labs included.
blog · netspi.com
Playing with Content-Type – XXE on JSON Endpoints
By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.
blog · netspi.com
Dumping Git Data from Misconfigured Web Servers
Web servers exposing their .git directory hand attackers the full repository history: the article covers finding exposed repos, mirroring them with wget, and recovering source and config data.
blog · netspi.com
Presenting at OWASP AppSec Conference
Antti Rantasaari and I will be delivering our presentation “Escalating Privileges through Database Trusts” at the National OWASP AppSec conference in Irvine, CA on September 10th.
vulnerability · netspi.com
ActiveX + XSS = ActiveXSS Pwnage!
After finding XSS in web apps running ActiveX plugins, NetSPI chains the two: extracting class IDs from page HTML, resolving the backing DLL via the registry, and fuzzing it with ComRaider.
back