Categoría: writeups

Excessive trust in client-side controls

Visible error-based SQL injection

CSRF where token validation depends on token being present

Information disclosure in version control history

Authentication bypass via information disclosure

Source code disclosure via backup files

Information disclosure on debug page

Information disclosure in error messages

SQL injection attack, listing the database contents on Oracle

SQL injection attack, listing the database contents on non-Oracle databases