XPATH Injection Tutorial

XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection allows an attacker to inject XPath elements in a query that uses this language. Some of the possible goals are to bypass authentication or access information in an unauthorized manner.We are gonna learn using simple example. Download code from here & put it in your local server directory.(Code is created by Amol Naik )Sample...

Read More

Broken Authentication & Session Management in Mutillidae

Broken Authentication and Session Management is on number 2 in OWASP Top 10 vulnerability list 2013. In mutillidae , it contain three subsection.Authentication BypassPrivilege EscalationUsername EnumerationWe have already covered Username enumeration in last article & we got valid username list which exist in database. Today we are going to use authentication bypass method.Using cookieUsing brute-forceUsing SQL injection(1)Authentication Bypass...

Read More

How to solve compile error in veil?

As you know, veil is AV evasion framework for metasploit payload. On the 15th of every month, for the next year, at least one new payload module will be released.Yesterday they released two new payload.pure windows/meterpreter/reverse_tcp stager, no shellcodepure windows/meterpreter/reverse_tcp windows service stager compatible with psexec, no shellcodeCompiler Error in c payloads:- Available c payloads:    VirtualAlloc                        ...

Read More

Username Enumeration in Mutillidae using Burpe Intruder.

Mutillidae  is a free, open source, vulnerable web-application providing a target for web-security tester. Mutillidae can be installed on Linux and Windows using LAMP, WAMP, and XAMMP. Username Enumeration :- We have an application that will reveal to us when a username exists on the system which can be used in further step like brute-force account.In Mutilliade login page , when you provide valid username & invalid password , web-application...

Read More