by Mike Saunders | Mar 27, 2019 | Blog Posts
Lots of pen test and red team blogs follow the same model: we came, we saw, we conquered, blue team tears flowed. This is not one of those blogs. TL/DR; Pen testing isn’t about finding vulnerabilities. It’s about finding opportunities for your client to...
by Mike Saunders | Nov 30, 2018 | Blog Posts
Did you know you can use DNS queries to exfiltrate data from a database via SQLi? No? Then continue reading! I’ll walk through some techniques you can use to enumerate and exfiltrate data from a DB server via blind SQLi. On a recent web app test, I encountered a...
by Mike Saunders | Sep 21, 2018 | Blog Posts
During a recent web app test, I encountered a situation when I would be randomly logged out of the application when running sqlmap. I wasn’t manipulating any of the session cookies and the logouts happened at random times. I needed a way to detect when I got...
by Mike Saunders | Sep 5, 2018 | Blog Posts
On a recent external web app pen test, I found a possible SQL injection vulnerability using the Burp Scanner. One of the tests triggered an A record lookup for the Burp Collaborator server. In the screenshot below, we can see the test that triggered the finding....
by Mike Saunders | Jul 19, 2018 | Blog Posts
During a recent web app engagement, I wanted to run some of the Burp Scanner automated checks, but I was confronted with several issues. First, this particular application did not respond kindly to manipulation of the session cookies. The application and its single...
by Mike Saunders | Jul 10, 2018 | Blog Posts
While certainly not a new topic, there has been plenty of discussion recently around the goals of pen testing. Many believe that getting DA is the be-all and end-all of an engagement. Others think it might be a valid finding, but falls short of meeting the actual...
Recent Comments