Oracle SQL Injection Guides and Whitepapers

Introduction SQL Injection is a hot topic like always, I have been explaining SQL injections with examples in my series of interesting SQL injection attacks, but this time I have gathered some resources on Oracle SQL Injection which can be handy for both penetration testers and developers alike. Oracle SQL Injection Guides and Whitepapers Oracle SQL Injection for Oracle Developers:-  This paper is intended for application developers, database administrators, and application auditors to highlight the risk of SQL injection attacks and demonstrate why web applications may be vulnerable.  It is not intended to be a tutorial on executing SQL attacks and […]

HTTP header Blind SQL injection Example

Microsoft Security Bulletin

Critical Vulnerability in Microsoft Translator hub writeup 1 comment

Introduction A month back I was hunting for Vulnerabilities in Microsoft Web services, as Microsoft has large online infrastructure, finding a vulnerability which could lead to Microsoft hall of fame for security researchers wasn’t difficult. While browsing around their online services, one of their services, Microsoft hub translator caught my eye. Microsoft hub translator is and I quote: “Microsoft Translator Hub empowers businesses and communities to build, train, and deploy customized automatic language translation systems—bringing better and specialized translation quality to established languages, and first-time automatic translation capabilities to the many languages that are not yet supported by major translation providers”. […]

Twin City Tester’s meetup at FAST University

Few days back , I was at FAST University for Twin City Testers meetup. The “Twin Cities Testers Meetup” (TCTM) was held on February 17th, 2015 at FAST Islamabad campus. The meetup was attended by more than 60 professionals from software testing and quality assurance industry, representing over 30 companies along with presence from the Academia.   I gave a talk on Penetration testing. My presentation was not much technical, although audience was professional, but they were from a slightly different background. As penetration testing comes under the big cloud of software testing, I wanted to talk about basics and then things that […]

Penetration testing talk at FAST

Referer Header SQL injection Example

Referer Header Based Blind SQL Injection Explained With Example 2 comments

Introduction Hello everyone, this post is third in series of posts that I will be doing on SQL injection. Earlier I explained Second Order SQL Injections with Example and Column Truncation SQL injection Vulnerabilities Hopefully I will be doing more of these, focusing only on topics that are not well explained anywhere else and providing examples so that readers can actually relate to what is going on. So in this post I will be explaining about referer header, blind SQL injection, I prepared a Demo for Referer Based Blind SQL injection will give a walk through of that. At the end, Blind SQL […]

Open URL Redirection in MSN earned Microsoft Hall of fame 1 comment

Hi, Some time back I was hunting MSN for Security related bugs, mainly for getting Microsoft Hall of fame. Microsoft has a hall of fame for security researchers who find vulnerabilities in microsoft online infrastructure, security researchers are then acknowledged by Microsoft in their hall of fame. I was interested in getting there, although i was already in MS HOF for this report. Although unlike other companies who offer Bug Bounty programs, for example Facebook rewarded me 500$ for reporting a vulnerability, they also have a Hall of fame, Microsoft don’t have a reward program for their online infrastructure, getting […]

Open URL redirection in MSN earned Microsoft Hall of fame

Cloudflare Web Application Firewall User Interface

Cloudflare Web Application Firewall Review 2 comments

  Cloudflare Web Application Firewall Review Hi, I hope most of you are familiar with Cloudflare, in short, CloudFlare protects and accelerates any website online. Check more details about their features Cloudflare Overview. I’m a fan of cloudflare right from the start. Cloudflare has a free account , pro and  business account, For over an year i was using cloudflare as a free member and enjoying all the benefits it offers free of cost. One of my personal favorite is that its a reverse proxy, so from security point of view, you can’t tell the IP address of the server my website is […]