Python Development of XSS Scanner1. Basic Approach1. Target Scanning2. Core Detection Logic3. Extensibility Design2. Code Implementation1. Dictionary File2. Python Code Python Development of XSS Scanner 1. Basic Approach 1. The overall approach is to send a request with a payload parameter value and determine the existence of the payload from the response (triggering reflected XSS). … Read more
The vulnerabilities described in this article have been fixed. Please do not conduct unauthorized penetration testing. Original source: https://sallam.gitbook.io/sec-88/write-ups/how-we-turned-a-medium-xss-into-a-high-bounty-by-bypassing-httponly-cookie Content The target application is a common website translation platform that includes team management, project management, and an AI feature module. During testing for privilege escalation and injection attacks, I discovered an interesting input field in … Read more
Disclaimer This article is for academic research purposes only and should not be used on real unauthorized websites. Any illegal use is not related to the platform or the author of this article, and you must take responsibility! What is HttpOnly HttpOnly is a boolean attribute in the Set-Cookie response header. Once added, the browser … Read more
HTTP Hypertext Transfer Protocol(HyperText Transfer Protocol)Introduction to Principles The HTTP protocol is a transmission protocol used to transfer hypertext from WWW servers to local browsers. It enables browsers to operate more efficiently and reduces network transmission. It not only ensures that computers transmit hypertext documents correctly and quickly but also determines which part of the … Read more
In the first part of my adventure, I arrived at the Nginx building, where I was greeted by the receptionist at station 04, who then directed me to Tomcat. There, I encountered the famous thread 0x6904, who took me to meet the head of the Struts Filter. We then went to the second floor to … Read more