It is frequently the case within web applications that redirects are used to direct the user to a different portion of the application. A typical example would be that of an application redirecting a user to the login page when accessing a page intended for…
Author Archives Invicti
THE AUTHOR
Invicti
Domain Fronting: Poking a hole in the Whitelist for Bypassing Firewalls
Domain Fronting is a widely popular technique that is used for evading Firewalls, DPI’s and censors. Domain Fronting takes advantage of legitimate high reputation cloud providers, more specifically, Content Delivery Networks (CDN), for evasion. This technique has been commonly used in the wild to circumvent…
What is Insecure Deserialization?
Insecure Deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application, inflict a denial of service (DoS) attack, or even execute arbitrary code upon it being deserialized. It also occupies the #8 spot in the OWASP Top…
OWASP Top 10 2017 Update – What You Need to Know
After the long-winding road of discussion and deliberation, revision, disagreements and adjustments, the Open Web Application Security Project (OWASP) are updating their venerable Top 10 list of the most critical web application security risks since 2013. This update brings with it three new entries to…
How do I update to the latest Invicti build?
Keeping Invicti up-to-date is important to ensure you always get the latest updates to existing and newly added tests, features, bugfixes and improvements. Fortunately it’s not only easy but transparent. By default Invicti automatically checks for updates, installs any new updates in the background without…
How to Backup Invicti
Backing-up your Invicti data and settings is important and should be done frequently, especially on production systems. This post will show how to do this manually and will also offer a sample implementation in PowerShell for automating the process. Stopping Invicti services Before taking a…
Getting Started with the Invicti Blind SQL Injector
The Blind SQL Injector is a tool that forms part of the Invicti Manual Pen Testing Tools suite (available to download for free). The Blind SQL Injector allows you to enumerate MySQL and MSSQL databases via a Blind SQL injection vulnerability. You can start using…
In the headlines: Yahoo hack, Krebs DDoS attack, Drupal vulnerabilities and more
500m users affected in giant Yahoo hack and lawsuits already filed The latest breach to be dubbed ‘the biggest breach ever’ is the newly revealed theft of the data 500 million Yahoo users, which took place in 2014. Yahoo admitted this news just last week,…
In the headlines: US Department of Energy, IBM census site, NSA cyber defense hack, Sage data breach and more
US Department of Energy invests $34m in cybersecurity The Department of Energy in the US is set to invest $34m in 12 individual projects aimed to secure the smart grid. The projects are described as being aimed to improve the ‘reliability and resilience’ of US…