Text Input Denials of Service Introduction Countless websites allow users to input characters in any number of locations. These can be usernames, passwords, about me sections, or in the case of today’s finding, a notetaking section in an inventory management system. …

How you can do the same to improve your career outlook — Consider supporting my work on https://www.patreon.com/themayor I’m regularly asked by people how to break into penetration testing who are in the same position I was in not long ago. It was less than a year ago I was at my wit’s end. I thought I was unemployable in IT in…

Introduction About a year ago I was conducting an internal assessment, and it was clear that the network was vulnerable to man in the middle attacks (in this case, IPv6 was vulnerable). Despite the network vulnerability, the client did a fairly decent job of limiting domain administrator usage across the network…

Issue Unprivileged users in Azure AD are permitted to invite guest users to the tenant. Recommended Remediation The following outlines the recommended steps that the systems and network administrators should take in order to secure the environment. After logging into the Azure tenant as a privileged user (i.e., Global Administrator), access the Azure Active Directory option. Select the User Settings blade under Manage.

Issue Users in the Azure Active Directory tenant can create new Microsoft 365 groups and Security groups. Recommended Remediation The following outlines the recommended steps that the Azure administrator should take in order to secure the environment. After logging into the Azure tenant as a privileged user (i.e., Global Administrator), access the Azure Active Directory option. Select the Groups blade under Manage.

Chapter Two — Socket Communications Part 1 In Lesson 1 we talked about how to configure a basic socket connection between two points and transfer data. In this lesson we will construct the foundations of the server and client, which will eventually be our payload. Prior to beginning, you will…

Introduction and Chapter One — Sockets Basics Introduction I remember struggling with slope formula in 10th grade geometry. Struggling with the concept, I asked the teacher if he could provide a real-life example of how to use slope formula so I could apply it in some way to help better understand…

Rack Attack What the heck is a Rack Attack? Rack Attack is a “middleware for blocking and throttling” in Ruby on Rails code (rack/rack-attack: Rack middleware for blocking & throttling (github.com). Rack attack allows a developer to set various rules in the configuration for allowing, blocking, and throttling requests. When it is used appropriately, Rack Attack can…

Unverified Password Change Introduction In today’s article we’ll talk about a super easy to find vulnerability covered under CWE-620 — Unverified Password Change. At the end of the article, we’ll go through the Huntr.dev …