Author: Mehmet Ince

Master Ninja @ Prodaft / INVICTUS Europe.

How to Test Horizontal & Vertical Authorization Issues in Web Application ?

Mehmet Ince Leave a comment

As you know, nowadays web applications could be as complex as operating systems. Most of those complexity comes from authorisation schemas. Such weaknesses are referred to in the literature as Insecure Direct Object Reference.

Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources in the system directly, for example database records or files.[1]  Read More

Phishery – Domain Credential Theft via Social Engineering

Mehmet Ince 1 Comment

Identifying the employees of the target organization via social media platforms such as Linkedin and sending related attractive mails comes first in the social engineering attacks. By tracking down social media, an adversary may understand most interesting topic about targeted company’s employees. After from that point, adversary may send out a phishing e-mail to the selected employees in order to steal a valid domain credentials. Read More

Data Exfiltration (Tunneling) Attacks against Corporate Network

Mehmet Ince 7 Comments

Data exfiltration, also called data extrusion, is the unauthorized transfer of data from a computer. These type of attacks against corporate network may be manual and carried out by someone with USB or it may be automated and carried out over a network. In this article, we will focus on a network based data exfiltration techniques that must be covered during penetration test. Read More