Tag web

Security

You don’t need the lt and gt tags to have a successful cross-site scripting (XSS) vulnerability

While it’s definitely easier if the “<” and “>” tags are allowed, one can “convince” the target website to run javascript even if the tags are escaped. For example we have this search box: Once we run the search, we…

malwrforensics
February 5, 2018

Security

WebPwnTool

This is a python script designed to automatically find XSS (cross-site scripting), directory traversal/LFI (local file inclusion) and open redirect vulnerabilities. It uses a predefined dictionary for XSS/LFI attacks that can easily be extended. The open redirect vulnerabilities are checked…

malwrforensics
January 13, 2018