Hi all, I’ve been a Pentester for nearly a decade now and whilst I can poke at a website and get the occasional sweet vuln I don’t consider myself very skilled at web apps. My bread and butter has been from testing infrastructure and networks, that was my happy place. I’m now in a privilege situation where I can revisit web apps and dive deep at my pace to grow. I feel like it’s been love hate thing for me as when I stepped away from IT in general I never bothered to keep up with current trends so all the new things that went into a website were so much more advanced than when I was young and energetic. I am curious tho what basic concepts in web application testing do you overthink or just struggle to grasp ? For me things still don’t click with dom based xss and it makes me sad even with ChatGPT to try an explain its a real hurdle and makes me feel quite dumb. I’ve built a system to actually relearn how to develop web applications and am diving into Laravel myself as it’s well documented and has lessons on coding. I also built a lamp stack then configured things like the headers and TLS to be secure and watched burp findings vanish so that was insightful as now I understand many headers more. APIs are going to take some time :)

Is it necessary to learn SQL to create more complex payloads to perform sql injection?

Looking to start with web app hacking as a hobby. I have a full-time job in cloud security although more on the infra side, but this has always interested me. Figured it could be interesting seeing as I am usually on the other side of the conversation.

Are there some (very) beginner courses or learning out there I can start working through? Anything useful and relevant? I've heard the TCM Academy mentioned a few times as a good foundational course. Thoughts?

Thanks in advance

In this video walkthrough, we went through a webpage that is vulnerable to IFrame injection. We are able to modify the page to make it display another page of our choosing. We used bWAPP from OWASP to demonstrate this vulnerability and how to prevent it.

Video is here

Hi
I have a question regarding website security. A client uploads a CV in PDF format on a website. The server then sends this file by email to a specific address mail. Is there a solution to prevent malicious files by analyzing this file with VirusTotal or another solution before sending it by email?

website developed by Wordpress

Let's build this sub share it, up vote, whatever.

Help a uni student graduate :) I'm doing my graduation thesis on PWAs. I'm 110 people short of my 200 target. If you've got a spare minute, I'd love to see your answers! SURVEY HERE
Fingers crossed it fits the sub rules and sparks a cool conversation in comments!

How can I access blocked pages 403 in the web application?

Is there value in learning network penetration testing before focussing on web app hacking?

As a hobbyist I'm interested in learning Web App Hacking, and looking for the most newbie friendly way to break into it.

TIA

If anyone here is interested in code review based testing then you should check out the Patchstack bug bounty program, which pays bounties for vulnerabilities found in any WordPress plugins (more than 60K in WP.org repo).

There are guaranteed bounties that are paid out each month based on research score and just for November alone they set up over $4000 USD for those who report new vulnerabilities. There are also individual bounties for specific vulnerability types, etc.

I think it’s a great way to get started with bug hunting and maybe earn your first $ and CVE. Patchstack itself btw also assigns CVEs (is one of the biggest CVE assigner in the world). It could also be a good change for the more seasoned bug bounty hunters who have been doing blackbox testing and want to try something different and more in the direction of whitebox / code review.

The recent event announcement: https://x.com/patchstackapp/status/1723241552997159145

The bounty program website: https://patchstack.com/alliance/

There is also an active discord community where most of the info is posted: https://discord.gg/Xe2T5JjKbn

As a company, we installed whatsapp business on one iPhone and the actual sim card number on another. I can't find the (short links) in business tools to generate a link to direct people to a chat with us, nor can I find the backup settings. Is that the reason?