Finding, exploiting, and fixing open redirect vulnerabilities in web applications.

XSS Cheat Sheet 2019 Edition is a quick reference material for bug hunters, pentesters, security analysts, web application security students and enthusiasts.

I can read your passwd file with: “/???/??t /???/??ss??”. Having fun with Sucuri WAF, ModSecurity, Paranoia Level and more…

String concatenation in a Remote Command Execution payload makes you able to bypass firewall rules (Sucuri, ModSecurity)

DOM XSS – auth.uber.com  So, after reading a lot of write ups about bug bounty its finally time to write one of my own. I hope that ...

How to bypass filter_var(), preg_match() and parse_url()

Vulnerability in Chrome, Firefox, and Opera makes users susceptible to phishing with Unicode domains

In order to bypass IP based blocking, we at Rhino Security Labs created a Burp Suite extension that uses AWS API Gateway to change your IP on every request.

Penetration testing tools cheat sheet, a high level overview / quick reference cheat sheet for penetration testing.

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

The Bug Hunters Methodology. Contribute to jhaddix/tbhm development by creating an account on GitHub.

A file inclusion vulnerability allows an attacker to access unauthorized or sensitive files available on the web server or to execute malicious files on

From CSRF to user information leak, XSS and full account takeover.

Hi everyone and welcome back on this new write-up.

A bug allows anyone who has the victim’s phone to read all their contact list without unlocking the security lock

Once upon a time, a friend of mine asked me a question — "Do you know any fresh RCE for the Jenkins environment ?". I was informed already…