Cyber Security Enthusiast/Learner

OSWE, or the Offensive Security Web Expert, is a certification that demonstrates a high level of expertise in the field of web application security. To prepare for the OSWE exam, it is important to have a strong foundation in the following areas: Web application architecture: Understanding the various components and technologies that make up a web application, such as the client-side (e.g., HTML, CSS, JavaScript), the server-side (e.g., databases, servers), and the communication between them (e.g., HTTP). Web application vulnerabilities: Familiarity with common web application vulnerabilities, such as cross-site scripting (XSS), SQL injection, and cross-site request forgery (CSRF), and how to exploit and mitigate them. Web application testing: Knowledge of the various tools and techniques used to test and assess the security of web applications, such as manual testing, automated testing, and penetration testing. Web application frameworks: Experience with common web application framewo...

Static code analysis is the process of analyzing code for potential issues or vulnerabilities without actually executing it. It is a valuable technique for identifying issues early in the development process, as it can help identify problems before they become more costly or difficult to fix. Here are some steps you can follow to learn static code analysis: Familiarize yourself with the basics: It is important to understand the principles and concepts of static code analysis before diving into specific tools and techniques. This may include understanding the types of issues that static code analysis can identify, such as security vulnerabilities, performance issues, and coding standards violations. Choose a static code analysis tool: There are many different static code analysis tools available, each with its own features and capabilities. Some popular options include SonarQube, Fortify, and Checkmarx. Consider your specific needs and the languages and frameworks you will be working wi...

OWASP, or the Open Web Application Security Project, is a non-profit organization that aims to improve the security of software and the web. One of their most well-known initiatives is the OWASP Top 10, a list of the most common and most critical web application security risks. The OWASP Top 10 is regularly updated to reflect the current state of the threat landscape and to provide guidance on how to address these risks. Here is an overview of the OWASP Top 10 for web applications: Injection: This occurs when an attacker is able to send malicious code to a web application, which is then executed by the application or the underlying database. Examples include SQL injection, where malicious SQL code is injected into a database query, and cross-site scripting (XSS), where malicious JavaScript code is injected into a web page. Broken authentication and session management: This risk occurs when an attacker is able to gain unauthorized access to a user's account or to manipulate the sess...

WALKTHROUGH (spoiler) OF PRINTER HACKING 101 by swafox in Try Hack Me   (tryhackme.com)   Unit 1 introduction   In This section the creator of the room shared some quick info about the famous Pewdiepie hacking. Where the hacker hacked about 50,000 printers and printed a page asking for subscribing to pewdiepie youtube channel 😊     Unit 2 ipp port   The cause of pewdiepie hacking was the open IPP port. An open IPP port can expose a lot of sensitive information such as printer name, location, model, firmware version, or even printer wifi SSID. What port does IPP run on? 631     Unit 3# Targeting and exploitation In this section we have the deploy button to Deploy the machine A handy tool for printer exploitation is shared. Github: https://github.com/RUB-NDS/PRET The Printer Exploitation Toolkit is a handy tool that is used for both local targeting and exploitation. There are exactly three options you nee...

 In Wordpress we can do a username enumeration in several ways. We can do it via Metasploit or Nmap NSE Script. But if both of these are not available or we want to use another simpler method, here is one mentioned below. A Bash Script to enumerate Wordpress usernames. Copy the below Bash code text into a .sh file. Change the website to URL to your desired URL. Change the range of user ids default is 1 to 20. Then chmod the file to make it executable ( chmod +x filename.sh)(in linux terminal) and run ./filename.sh. BASH Code:  for i in {1..20}; do curl -s -L -i http://www.your-desired-website/?author=$i | grep -E -o "\" title=\"View all posts by [a-z0-9A-Z\-\.]*|Location:.*" | sed 's/\// /g' | cut -f 6 -d ' ' | grep -v "^$"; done CYB3RTR0N , 574r570rm