API Penetration Testing🔐 Part 2
Reverse engineering APIs with Postman and mitmproxy2swagger, finding excessive data exposure, and scanning for weaknesses. Part two of API testing.
Blog
Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.
API Penetration Testing 🔐
Building an API penetration testing environment: Kali Linux, Burp Suite, OWASP ZAP, FoxyProxy and labs built for finding hidden API endpoints.
FUZZ Everything! 📂
How to use ffuf to fuzz everything: hidden directories, file extensions, API endpoints, parameters and backup files that normal recon never surfaces.
VPN? 🔐 DPN? 🌍 TOR? 🧅
VPNs, DPNs and Tor solve different privacy problems. How each one actually works, where the trade-offs are, and which to use for which threat model.
$1 Bug Bounty
Why low-hanging fruit is the right place to start in bug bounty, the common easy wins to look for, and how small findings build toward bigger ones.
Master Code Injection Attacks, Ethically! 🔐
Two hands-on code injection labs: injecting OS commands in a PortSwigger lab, then escalating to a PHP reverse shell in bWAPP automated with Commix.
Build Your Private Local AI Server Right Now!
Run large language models on your own hardware: WSL and Ubuntu, Ollama setup, adding models, and monitoring GPU performance on a fully private server.
🚀 Get Your First Zero-Day RIGHT NOW!
Get started finding zero-days in binary software and web applications, from setting up VMware to fuzzing real targets with AFL.
CSRF - Automate Vulnerability Testing 🛡️🔍
Automate cross-site request forgery testing with Burp Suite and Project Forgery, a Python tool for generating and validating CSRF proof-of-concepts at scale.