Etiqueta: Practitioner

SQL injection UNION attack, determining the number of columns returned by the query

SSRF with blacklist-based input filter

Exploiting NoSQL operator injection to extract unknown fields

Exploiting NoSQL injection to extract data

Blind SSRF with out-of-band detection

CSRF where token validation depends on request method

File path traversal, validation of file extension with null byte bypass

File path traversal, validation of start of path

File path traversal, traversal sequences stripped with superfluous URL-decode

File path traversal, traversal sequences stripped non-recursively