Authentication is one of the most crucial aspects when it comes to the security of an application. However, suppose an attacker can bypass the implemented authentication by any means. …

Cyber Security, Ethical Hacking, Application Security, Penetration Testing, Bug Bounties, etc., these career options are blooming and becoming popular among teenagers, scholars, experienced professionals, etc. globally. The reason for this popularity is surely the growing community, increased attacks, and need for skilled professionals. However, this domain is at a time…

Cookies are a widely used way to enable authentication in many of the applications out there. Over time, there has been a lot of security implications in Cookie-Based Authentication and new methods such as token-based authentication has entered the picture. Although many modern applications are adapting Token-Based authentication, Cookie-Based Authentication…

Web Application is commonly found part of any organization’s infrastructure and often is exposed publicly and accessible by the world. Due to this, an attacker usually considers attacking the web applications in order to gain an initial foothold into the organization’s network. From my personal experience being a Pentester &…

Reconnaissance (aka Recon) is an essential process in pentesting, especially Black Box Pentesting, where you don’t have specifics about your target. Before starting to hit your target, it is important to gather as much information as possible about your target to specify your Attack Surface area. …

Multi-Factor Authentication (MFA) often known as Two-Factor Authentication (2FA) is an added layer of protection added to an application in order to enhance the overall security of the user’s account. Multi-Factor Authentication Workflow The user navigates to the Application’s Login Function and provides login credentials. Upon which, the application invokes…

The penetration Testing domain has grown exponentially in the last couple of years and so the competition. Validating and Proving your skills in a short interview call isn’t always a win-win situation for both the employee and employer and this is where various security certification comes into the picture. …

Arbitrary URL Redirection Attack often is popularly known as an Open Redirection attack, which is a common web vulnerability that allows an attacker to redirect the victim user to an attacker-controlled domain. This attack can leveraged to steal sensitive information such as tokens, perform social engineering, and other attacks. The…

Insecure Direct Object Reference falls under the category for Broken Access Controls as per OWASP TOP 10 (2017 Edition). This issue usually occurs due to weak implementation of the application’s access control logics which links an identifier or an object to a particular asset say user_id parameter defines which user’s…