Cloudflare transform rules to get an A+ in the security header.
Getting A+ grade in securityheaders.com for a static website using Cloudflare transform rules.
All Posts
2023
Exploiting thousands of Domains for XSS
Exploiting goDaddy service to affect thousands of domains with cross-site scripting vulnerability.
2022
How I bypassed PHP functions to read sensitive files on server
Bypassing file read restriction on an application to achieve Remote Code Execution.
2021
MSSQL Injection In JSON Request
MSSQL Injection in android application from JSON Request.
Blind XSS on Google Internal System
Blind cross-site scripting (XSS) refers to a type of code injection where an attacker inserts XSS payload in user input fields and...
2020
GraphQL IDOR in Facebook streamer dashboard.
While viewing our stream dashboard data from creator studio, there is an endpoint from where we can see our dashboard status. There is parameter called profi...
Stored Cross Site Scripting on Mdaemon Webmail (20.0.0)
XSS on Mdaemon webmail affecting versions < 20.0.0. Assigned CVE-2020-18723 and CVE-2020-18724
CVE-2020-10596 in OpenCart
Authenticated Stored Cross Site Scripting (XSS) in OpenCart 3.0.3.2.