https://aegrah.github.io/categories/web-application-hacking.htmlRecent content in Web Application Hacking on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudMon, 20 Jun 2022 13:33:35 +0200https://aegrah.github.io/post/2022-06-21-web-application-hacking-server-side-request-forgery.htmlMon, 20 Jun 2022 13:33:35 +0200https://aegrah.github.io/post/2022-06-21-web-application-hacking-server-side-request-forgery.html This blog post will cover server-side request forgery (SSRF) attacks. Along the way we will be covering what a SSRF is, take a look at the basics of a SSRF attack, discuss several more advanced SSRF attacks and learn about the ways to prevent your web application of being vulnerable to these types of attacks. While analyzing the topic, we will be going through several easy and more advanced labs, which are available for free at PortSwigger academy.https://aegrah.github.io/post/2022-05-19-web-application-hacking-command-injection.htmlWed, 18 May 2022 13:33:35 +0200https://aegrah.github.io/post/2022-05-19-web-application-hacking-command-injection.html In the fourth post regarding web application security, we will be diving into OS command injection or shell injection attacks. We will be covering what command injection is, what different types of command injection attacks exist and how to prevent command injection vulnerabilities within your own web applications. While analyzing the topic, we will be going through several easy and more advanced labs, which are available for free at PortSwigger academy.https://aegrah.github.io/post/2022-05-18-web-application-hacking-directory-traversal.htmlWed, 18 May 2022 13:33:35 +0200https://aegrah.github.io/post/2022-05-18-web-application-hacking-directory-traversal.html In this post we will be taking a look at the directory traversal or path traversal vulnerability. I'll go over what directory traversal exactly is, how we can weaponize it, how we can bypass common protections and misconfigurations and lastly how to prevent it within your own web application. While elaborating on this topic, I will be going through several easy and more advanced examples that are available for free at PortSwigger Academyhttps://aegrah.github.io/post/2022-05-11-web-application-hacking-sql-injection.htmlFri, 13 May 2022 13:33:35 +0200https://aegrah.github.io/post/2022-05-11-web-application-hacking-sql-injection.html This post will explain what SQL-injection (SQLi) is, how we can find SQLi vulnerabilities in web applications, how we can weaponize this vulnerability and how to prevent it. While researching and explaining the topic, we will go through several easy and more advanced examples that are available for free at PortSwigger Academy. What is SQL-injection? Let's first take a look at what SQL exactly is. SQL, or Structured Query Language, is a standard language for storing, manipulating and retrieving data in databases (some examples include but are not limited to MS SQL Server, Oracle and MySQL).