PinnedPHPObjectInjectionLFI to RCE — Hello readers, today we are gonna talk about PHPObjectInjection and leveraging the power of Reflection to modify the serialized objects and access any arbitrary files from the server, later we will learn how to convert it into an RCE (Remote Code Execution). let the hunt begin; What is PHPObjectInjection? Before…Webpentestration5 min readWebpentestration5 min read
Published inCoinsBench·Jul 11, 2022Crypto Flaw — Insecure Direct Object Reference (IDOR)Crypto flaw to access sensitive customer data Hello readers, so, I’m back with another interesting attack. During a recent pentest, I came across this cryptography flaw that basically was a client-side attack and was having its encryption logic deployed on the client-side. With the aid of this utility, I was…Pentesting3 min readPentesting3 min read
Apr 28, 2022Functionality Bypass — IDOROTP Bypass to IDOR (Insecure Direct Object Reference) — Hello readers, so today I’m gonna talk about how the weaker implementation of an OTP functionality in an application allowed me to access the critical customer data, download the KYC details uploaded by the customer, and make a false payment on behalf of a legitimate customer. Let the hunt begin. …Vulnerability Assessment3 min readVulnerability Assessment3 min read
Jun 14, 2021Dependency Confusion AttackThe Story of a Novel Supply Chain Attack — Hello readers, so today I’m gonna talk about Dependency Confusion Attack and how to perform this attack in the real world. This attack comes into the picture when the user wants to install any sort of package, library, repos, etc. from the internet. Usually, the user only needs to specify…Pentesting6 min readPentesting6 min read
Published inCoinsBench·Jun 6, 2021IDOR (Insecure Direct Object Reference)Accessing Arbitrary Customer data — Hello readers, today we are gonna talk about IDOR, I know most of you must be knowing what IDOR is and different ways to execute the attack. So, today we are gonna talk about another way to execute this attack which is based on the client-side restrictions and ways to…Web Penetration Testing3 min readWeb Penetration Testing3 min read
Oct 16, 2020Need for an Information Security PoliciesBefore we talk about the necessity of an Information Security Policy, let me introduce myself, my name is Antara Mane and I’m working as an InfoSec Analyst/Auditor for the past 2+ years. You might be having a question concerning “Why an obligation to understand Information Security, and what is exactly…Information Security4 min readInformation Security4 min read
