DOCSEARCHbyAlgolia
Submit Docs

RezyDev Web Hacking Notes

website·Indexed 29 days ago

https://rezydev.com

A comprehensive collection of security research and technical notes on web vulnerabilities. Topics include SQL injection, Cross-Site Scripting (XSS), CSRF, JWT and JWE attacks, XXE, insecure deserialization, and specific CVEs such as CVE-2016-5386 and CVE-2019-5418. Includes methodologies for exploitation, root cause analysis, and guides on tools like Ligolo-ng.

Tokens
124.4K
Snippets
689
Records
950
Agent score
49%

What's inside RezyDev Notes

  1. Overview of Android Application Penetration Testing

    Android Application Penetration Testing (Android Pentesting) involves assessing the security posture of Android applications, their backend services, and the mobile ecosystem. The objective is to identify vulnerabilities that could lead to unauthorized access, security control bypasses, data theft, functionality manipulation, or privacy compromises. Because Android apps interact with device hardware, OS permissions, inter-process communication (IPC), and local storage, a comprehensive assessment requires a combination of static analysis, dynamic analysis, reverse engineering, network testing, and runtime manipulation.

  3. Overview of iOS Application Penetration Testing

    iOS Application Penetration Testing (iOS Pentesting) involves assessing the security posture of iOS applications, their backend services, and the Apple ecosystem. The objective is to identify vulnerabilities that could lead to unauthorized access, security control bypasses, data theft, or privacy compromises. Due to the closed nature of the platform, assessments typically combine static analysis, dynamic analysis, reverse engineering, network testing, and runtime manipulation. Testing strategies generally involve a mix of non-jailbroken analysis (using simulators or physical devices) and jailbroken-device techniques for deeper system inspection.

  4. Overview of Windows Remote Management (WinRM)

    WinRM is a Microsoft protocol that enables remote management of Windows machines using SOAP-based communication. It allows administrators to execute commands, manage processes, and retrieve data remotely via the Windows Management Instrumentation (WMI) service.

  5. Overview of the ExtraSids Attack

    An ExtraSids attack is a post-exploitation technique used to gain elevated privileges (such as Domain Admin) in a parent domain after compromising a child domain. The attack works by injecting extra Security Identifiers (SIDs)—specifically the SID of the Enterprise Admins group from the root domain—into an access token (Golden Ticket). This exploits how Windows evaluates token privileges to allow lateral movement from a child domain to the parent domain.

  6. Understand the S2-052 root cause and attack surface

    S2-052 is an Insecure Deserialization vulnerability. The Struts REST plugin uses XStream for XML deserialization but lacks proper class filtering. This allows an attacker to send a crafted XML payload that is deserialized into Java objects, leading to arbitrary object creation and remote code execution (RCE). No authentication is required. The attack surface includes endpoints accepting application/xml or application/json (which is converted internally), typically via POST requests to common REST URLs such as /orders, /users, or /api/*.

  7. Understand and identify Signing Oracle vulnerabilities

    A signing oracle vulnerability occurs when an application provides a feature that signs user-controlled data using a secret key. If the application uses the same signing method and secret key across different system components, an attacker can use a legitimate signing feature to generate a valid signature for malicious data (e.g., changing a user ID or role) and then submit that signature to a restricted endpoint that trusts the same key. This effectively allows the attacker to bypass authorization controls, similar to a signed version of an Insecure Direct Object Reference (IDOR) attack.

  8. Understand Password Spraying and Defenses

    Password spraying is an attack where an adversary cycles through a small set of commonly used passwords across many AD user accounts to avoid triggering account lockout policies. Common targets include Kerberos (TGT requests), NTLM, LDAP, and web portals. Common tools include Rubeus, CrackMapExec, and Kerbrute.

    Defensive measures include:

    • Enforcing strong password policies.
    • Enabling smart lockout policies.
    • Monitoring Event ID 4625 (failed logins).
    • Implementing Azure AD Identity Protection.
    • Enforcing Multi-Factor Authentication (MFA) for external services.

  9. Understand the iOS Core Audio stack

    The low-level audio stack in iOS consists of Core Audio, AudioToolbox, and AudioUnit. This stack handles audio playback, recording, and processing pipelines. Because the OS must parse audio files (such as MP3, AAC, and CAF) before they reach an application, these parsers are frequent targets for remote-exploit attempts via malformed audio files.

  10. Understand and identify Mass Assignment vulnerabilities

    Mass Assignment is a security vulnerability that occurs when an application automatically binds user input to object properties without proper filtering or restrictions. This typically happens in frameworks using Object-Relational Mapping (ORM) or automatic data binding, allowing attackers to modify sensitive fields (e.g., changing a user role to 'admin') leading to privilege escalation or data breaches. Common affected technologies include Ruby on Rails (Active Record), Node.js (Express + Mongoose), Laravel (PHP), Django (Python), Spring Boot (Java), and ASP.NET Core (C# Model Binding).

  11. Understand ECB encryption weaknesses

    Electronic Code Book (ECB) encryption splits plaintext into fixed-size blocks and encrypts each block independently using the same key. This introduces several critical security weaknesses:

    • Identical plaintext blocks result in identical ciphertext blocks.
    • Encrypted blocks can be removed, reordered, or reused without the attacker knowing the encryption key.
    • There is no built-in integrity or authenticity protection.

  12. Understand Adversarial Security Roles and Programs

    Beyond standard pentesting, organizations use different adversarial and defensive frameworks:

    • Red Teaming: A holistic, stealthy approach to assess the overall security posture and test detection/response mechanisms.
    • Blue Teaming: The defensive side focused on monitoring, detecting, responding to threats, and maintaining secure configurations.
    • Bug Bounty Programs: Crowd-sourced security where ethical hackers are rewarded for finding vulnerabilities within a defined scope.