mpafis

I make and break websites. Web Dev, Security Researcher. Chipriota, sere Malagueno

[mpafis @mpafaros]

Day 5:
- Attacking account lockout policy
- Bypassing rate limits
- Bypassing CAPTCHA
- Bypassing dynamic CAPTCHA with OCR
- Attacking "Forgot password" functionality
- Password reset poisoning via Host Header Injection
#BugBountry #RoadTo1000

[mpafis @mpafaros]

Day 4:
Completed @WebSecAcademy Authentication vulnerabilities learning path to solidify my understanding from yesterday's material.
#BugBounty #RoadTo1000

[mpafis @mpafaros]

Day 3:
Read about authentication attacks using username enumeration through error messages and timing attacks, brute-forcing and form-based auth attacks. Tied it all together with some great labs from @WebSecAcademy.
#BugBounty #RoadTo1000

[mpafis @mpafaros]

Just finished chapter 1 of the Web Hacking Arsenal.
Really interesting stuff
- Browser layers, security policies / mechanisms
- Policy bypasses and vulns
- Address bar spoofing / anti-phishing filter bypasses
- HTTP/2 vulns from the @PortSwiggerRes team
#BugBounty #RoadTo1000

[mpafis @mpafaros]

Just finished reading the Web Hacking Arsenal section about HTTP and data encoding methods and even though I work with browsers and HTTP requests daily I didn’t even realise how many vulnerabilities there are in HTTP headers. #BugBounty #RoadTo1000

[mpafis @mpafaros]

Here we go