Posts

AWS Role Assumption Credential Configuration

I’ve documented an easy way to automatically configure AWS assumed role credentials. The AWS CLI handles all the complexity of assuming the role and credential management behind the scenes. Continue reading AWS Role Assumption Credential Configuration

Comprehensive JWT Penetration Testing Checklist

I’ve compiled a thorough JWT pentest checklist, including all the code you’ll need with step by step instructions. Continue reading Comprehensive JWT Penetration Testing Checklist

Account Takeover in Danphe Health Hospital Management System EMR version 3.2

Any authenticated user can takeover other accounts, including the admin account, due to Broken Function Level Authorization on the /api/SecuritySettings/ResetPassword endpoint. Continue reading Account Takeover in Danphe Health Hospital Management System EMR version 3.2

How Spammers and Scammers Hide The External Email Banner

This article explains what I learned while discovering how an email spammer hid the “External Email” enterprise banner. Continue reading How Spammers and Scammers Hide The External Email Banner

Better LLM Prompts Using XML

This article explains why using XML solves some problems with prompting and provides better results from an LLM. Continue reading Better LLM Prompts Using XML

Finding CDN Origin Targets

This article demonstrates how to find CDN (Akamai & Cloudflare) web application origin servers. If these origin servers aren’t properly limiting source IP addresses to the CDN, you can hard-code the name to IP address mapping in your hosts file to bypass the WAF. Continue reading Finding CDN Origin Targets

Scanning CDN Origin Targets

This article discusses the importance of using hostnames instead of IP addresses when conducting vulnerability scans or penetration tests. It explains how protocols like HTTP behave differently depending on how they are addressed, and how this can lead to missed vulnerabilities when only IP addresses are used. Continue reading Scanning CDN Origin Targets

Cracking Adobe Experience Manager Hashes

Adobe Experience Manager (AEM) password hashes are not supported by Hashcat. Follow along as I show how to install a compatible version of John, convert, and finally crack the hash. Continue reading Cracking Adobe Experience Manager Hashes

Going the Extra Mile - BXXS Edition

As a pentester, you’re going to be going up against external or web app scopes that have been beat up by pentesters and vulnerability scanners. This is about using Blind Cross-Site Scripting (BXSS) in going the extra mile. Continue reading Going the Extra Mile - BXXS Edition

Using the Chaos DNS API to Enumerate Pentest Subdomains

For your pentest, you’re given a list of IP addresses and some domains in scope. Using this methodology you can use the Chaos API to enumerate subdomains. Continue reading Using the Chaos DNS API to Enumerate Pentest Subdomains