Category Web Attacks

SSTI, Security, Web Attacks

SSTI – Basic server-side template injection (code context)

ssti lab 2 - alligator hacking and drinking coffee - featured image

Time for the second blog post as in regards to Server-Side Template Injection. This next lab goes a little deeper than the first. For the first lab, all we had to do was identify where a template may be in…

scomurr
02/08/2025

SSTI, Security, Web Attacks

SSTI – Basic server-side template injection

Server Side Template Injection - SSTI - Basic Squirrel Hacking

I love hacking. Recently, YesWeHack released a video on YouTube of Brumens’s talk about advanced SSTI techniques from the 2024 Ekoparty conference. This has inspired me to circle back on this topic, redo the Portswigger labs and document. I know…

scomurr
02/08/2025

Web Attacks, Security

CORS Vulnerability with Null Origin

Reflected origin lab conquered – now, let’s look at when the server side accepts a null origin. Why would a developer ever allow server side to accept a null origin? Sometimes web applications need to use other protocols (file:// for…

scomurr
12/07/2024

Web Attacks, Security

CORS Vulnerability with Origin Reflection

burp lab for cors reflected origin vulnerability

It’s time to get back to the labs on PortSwigger Web Security Academy. For this lab, we’re dealing with a CORS vulnerability with Origin reflection. We’re dealing with Same-Origin Policy and Cross-Origin. Here’s a few reference links for additional content:…

scomurr
12/03/2024

Security, Web Attacks

Understanding Same-Origin Policy (SOP)

What Is Same Origin Policy When looking to implement a new chunk of JavaScript or exploring credential exfiltration for bug bounty, we definitely run into CORS (Cross-Origin Resource Sharing). In order to understand CORS, it is important to understand Same-Origin…

scomurr
12/02/2024