HTML injections (HyperText Markup Language injections) are vulnerabilities that are very similar to Cross-site Scripting (XSS). The delivery mechanisms are exactly the same but the injected content is pure HTML tags, not a script like in the case of XSS. HTML injections are less dangerous…
XSS Filter Evasion Basics
The two primary methods of avoiding Cross-site Scripting (XSS) vulnerabilities are XSS filtering and XSS escaping. However, XSS filtering is not recommended because it can usually be evaded using clever tricks. Here are some of the methods that an attacker can employ in their malicious…
What Is Cookie Poisoning
The term cookie poisoning is used in different contexts to describe attacks that aim to manipulate, intercept, or forge the content of HTTP cookies. Cookie poisoning attacks are different types of attacks that can affect both the client-side application, data transmission, or the web server….
How and Why to Avoid Unvalidated Redirects and Forwards?
Unvalidated redirects and forwards cannot harm your website or web application but they can harm your reputation by helping attackers lure users to malware sites. If you allow unvalidated redirects and forwards, your website or web application will most probably be used in phishing scams….
What Is Integer Overflow? – Consequences & Prevention
An integer overflow is a type of an arithmetic overflow error when the result of an integer operation does not fit within the allocated memory space. Instead of an error in the program, it usually causes the result to be unexpected. Integer overflows have been…
Top 10 Invicti Blog Posts in 2019
The year 2019 has been very exciting for Invicti with many changes and unprecedented growth. Not only did we unveil the long-awaited Invicti 360 for our enterprise clients but we also moved to bigger offices and our team grew almost two-fold! The Invicti engine has…
What Are JSON Injections
The term JSON injection may be used to describe two primary types of security issues: Server-side JSON injection happens when data from an untrusted source is not sanitized by the server and written directly to a JSON stream. Client-side JSON injection happens when data from…
What Is Session Fixation
Session fixation is a web attack technique. The attacker tricks the user into using a specific session ID. After the user logs in to the web application using the provided session ID, the attacker uses this valid session ID to gain access to the user’s…
How I Found an XSS in Google using Invicti
I’m an independent security researcher and make my living mostly by cashing in on bounties. I use a lot of manual tools but I also find Invicti very useful. Recently, I found out that Invicti can even help me find a vulnerability in Google. Here…