Need support? or want to support? contact me or make a donation

Hi Everyone,

I hope you people are enjoying my posts here. I am trying my best to share as much information as possible. In this blog, I will share my write ups, programming techniques, information on hacking and other stuff related to technology.

Contacting Me

 Please contact me only for the following purposes

  1. You're in doubt or want me to clarify any of the things I've described in any of my post
  2. You'd like to share additional information which you want to see appear in my blog (with a credit to your profile)
  3. I am working as a freelance web, mobile app developer and a website designer and You want to assign any project or want to outsource a project.
  4. Want to pentest your website or secure/hack proof your website or web app.
  5. Invite to Private Bug Bounty Programs
  6. To request contribution in your JavaScript Open Source projects
You can reach me at sagarvd1995[at]gmail[dot]com or sagarvd[at]vdevs[dot]in

Support Me

If you liked my posts or my posts helped you somewhere, you can support me to so that I can contribute more time in sharing useful informations.

You can donate via Paypal or Buy me a coffeeBuy me a coffee

Comments

Post a Comment

Popular posts from this blog

Hands On training | Google XSS Game

Image
Hello everyone,

In a previous post, I talked about XSS aka Cross Site Scripting. Hope you all got a basic knowledge now. In this post, I am giving you more information on XSS with a hands on training on the Google XSS Game. You can find a video on how to solve this at the bottom of the page.

At first, Google XSS Game is a training platform provided by google to practice XSS. It consist of 6 levels and in each level, you have to execute a JavaScript alert in order to advance to next level. In each level, you'll be provided with different problems and you've to execute the alert using different techniques in each level. This will help you to understand various methods than can be used to execute XSS in a web page.

There are hundreds of such websites available which allow you to practice various types of vulnerabilities.

So let's get started.

Navigate to https://xss-game.appspot.com. This is where the Google XSS Game is available.

You'll see a page like this




Click the but…
Read more

Download Guarded Profile Picture From Facebook

Image
Facebook recently introduced a feature called Profile Picture Guard. It protect others from downloading your profile picture. If you want to know more about it, you can read it here Profile Picture Guard | Facebook Help.

When turning on Profile Picture Guard, Facebook assure you that no one else can download your profile picture. Really??? 😆😆😆 Never!!!

I worked some time on it to see how can I bypass this restriction. Tried calculating the url to cdn but it requires a signature to access the file. Tried to view image and change dimensions and the result is negative.

What's next?

Think out of the Box.

I think I should leave it and change my target first. Then I decided to test it from my another account to check is there a way to bypass it.

Opened the profile picture and copied the url. Then I opened incognito to login to other account. Went to the url that I copied earlier and I was about to type my username and password in the login form at the top of page. Suddenly a pop up ca…
Read more

Introduction to XSS - Methods, Impact and Prevention

Image
When searching for hacking tutorials or reading through write ups, definitely you will come across the term XSS. In this post, I am going to explain what is XSS, what are it's impacts and how to achieve it with few examples.

XSS aka Cross Site Scripting is a vulnerability which allow the attacker to inject and execute JavaScript code on the target website. This allow attacker to log the victim details, make a phishing page, bypass csrf, get cookies and many more.

XSS is of 2 types. Stored and Reflected.

Stored XSS is the type of XSS when the user entered data is stored in the server and the displayed in any other page. For example parameters like name, place, about etc can be vulnerable to stored XSS.
That said, fields like password are stored once and never retrieved or showed in future, hence it is not vulnerable to stored XSS.

When this can be exploited?

The developer isn't validating user inputs.The developer added certain validations but they are client side only.
How to Ex…
Read more