Latest Posts

Analysing CVE-2023-51467 - Apache OFBiz Authentication bypass to Remote Code Execution
Feb 26, 2024 • java
This article aims to explore the details of CVE-2023-51467 and explain the process of constructing an exploit leading to Remote Code Execution.
Dive deep into Android Application Security - OWASP MSTG Uncrackable level 1 writeup
Sep 18, 2019 • android
Uncrackable Apps for Android is a collection of mobile reversing challenges maintained by the OWASP MSTG (Mobile Security Testing Guide) authors. Cracking and solving these challenges is a fun way to learn Android security.
From 4 sources to 3 sinks in DOM XSS - DomGoat level 1-10 (all levels) writeup
Feb 24, 2019 • ctf
DomGoat is a DOM Security learning platform written by Lava Kumar Kupan (from Ironwasp security) with different levels, each level targetting on different sources and sinks.
Analysis and Exploitation of Prototype Pollution attacks on NodeJs - Nullcon HackIM CTF web 500 writeup
Feb 15, 2019 • ctf
Prototype Pollution attacks on NodeJs is a recent research by Olivier Arteau where he discovered how to exploit an application if we can pollute the prototype of a base object.
Exfiltrating remote localStorage data with XSS - Insomnihack teaser 2017 "The Great escape part 2" web 200 writeup
Jan 22, 2017 • ctf
Exfiltrating data from remote browser localStorage using XSS (Insomnihack teaser 2017 web 200 writeup)
Exploiting internal tomcat server with SSRF - Insomnihack teaser 2017 Web 50 writeup
Jan 22, 2017 • ctf
Exploiting internal tomcat server (with default credentials) using SSRF (Insomnihack teaser 2017 Web 50 writeup)
eLearnSecurity Practical Web Defense (eWDP) course review
Sep 19, 2016 • ctf
Practical Web Defense is a unique course which focus on both attacking and *defending* web Applications unlike the traditional courses which focuses only on attacking applications.
Bypassing path restriction on whitelisted CDNs to circumvent CSP protections - SECT CTF Web 400 writeup
Sep 9, 2016 • ctf
How can we bypass CSP using whitelisted CDNs and path traversal (SECT CTF 2016 web 400 writeup)
©2016 0daylabs. All rights reserved.