AIO Web App Pentesting ChecklistI’m testing the capabilities of NotebookLM for extracting valuable information from sources and I believe it can often do a much better job…Oct 26Oct 26
11 Pro Tips for OAuth 2.0 PentestingTo build on the AI podcast based on RFC 6819 I recently posted, here are 11 specific tips for pentesters when dealing with OAuth 2.0:Oct 7Oct 7
Uncovering Critical Financial Bugs in a High-Profile Target - [A Pentester’s Diary]In a recent pentest, I found multiple bugs that, if exploited by threat actors, could have caused significant financial damage.Sep 11Sep 11
Privilege Escalation to Admin through an Import FeatureI usually skip the introduction when posting a writeup because I don’t need to teach you what privesc or BOLA are, you can google that…Apr 251Apr 251
Account Takeover [It Looked Secure at First]In a recent pentest for a client, I was going through the password reset flow. You know…Feb 152Feb 152
Account Takeover via Weak OTPI seem to keep writing ATO posts here. I don’t mind. These are cool. Some are so easily discovered that it baffles me how persistent…Nov 2, 2023Nov 2, 2023
The Domino Effect: How Multiple Bugs Lead to Account TakeoverIf you’ve spent sufficient time on a cybersecurity assignment so that the bigger picture falls into place, you know that some issues will…Oct 13, 2023Oct 13, 2023
Unauthenticated Massive PII LeakThis is probably the report that I’m most proud of. On top of that, it was the lengthiest I’ve ever written.Sep 13, 20234Sep 13, 20234
Account Takeover via Email ConfirmationIt’s the second account takeover I’m finding on a client pentest in the span of a few days. I’m not sure wth is going on…Jul 25, 20233Jul 25, 20233
Account (of the CEO) Takeover via Password ResetIn a web app pentest for a client, I found this interesting account takeover and I thought of sharing my findings with the infosec…Jul 10, 20231Jul 10, 20231
![Uncovering Critical Financial Bugs in a High-Profile Target - [A Pentester’s Diary]](https://miro.medium.com/v2/resize:fill:160:106/1*DcEkUaocH4IuUim_bvk7VQ.png)
![Uncovering Critical Financial Bugs in a High-Profile Target - [A Pentester’s Diary]](https://miro.medium.com/v2/resize:fill:320:214/1*DcEkUaocH4IuUim_bvk7VQ.png)
![Account Takeover [It Looked Secure at First]](https://miro.medium.com/v2/resize:fill:160:106/1*unRaRJh7wTAbQChRp1HoIg.png)
![Account Takeover [It Looked Secure at First]](https://miro.medium.com/v2/resize:fill:320:214/1*unRaRJh7wTAbQChRp1HoIg.png)
