Web attack surfaces, defenses, and testing methods.
View all tagsDNS Rebinding is an attack in which an attacker changes DNS answers for a hostname they control so that a browser first receives code from an external server and later connects through the same hostname to an internal-network or loopback service. The key is not hacking DNS itself, but exploiting the gap between a web origin's identity and its actual network endpoint.
A padding oracle is a decryption interface whose external behavior reveals whether the padding of
TL;DR: SQL Injection remains one of the most dangerous web vulnerabilities. This practical guide
TL;DR: Server-Side Request Forgery (SSRF) is a vulnerability that makes a server send requests to arbitrary URLs chosen by an attacker. It can enable access to internal networks, theft of cloud metadata, port scanning, and other attacks.