Medium Article
SecureShop CTF Room - Complete Walkthrough Guide
The SecureShop CTF lab is an educational cybersecurity challenge that mimics a vulnerable e-commerce
web application. This walkthrough tutorial offers in-depth step-by-step procedures for the
identification and exploitation of several security vulnerabilities related to the OWASP Top 10
Medium Article
OS command injection
OS command injection is also known as shell injection. It allows an attacker to execute operating
system (OS) commands on the server that is running an application, and typically fully compromise
the application and its data. Often, an attacker can leverage an OS command injection vulnerability
to compromise other parts of the hosting infrastructure, and exploit trust relationships to pivot
the attack to other systems within the organization.
Medium Article
File upload vulnerabilities
File upload vulnerabilities are when a web server allows users to upload files to its filesystem
without sufficiently validating things like their name, type, contents, or size. Failing to properly
enforce restrictions on these could mean that even a basic image upload function can be used to
upload arbitrary and potentially dangerous files instead. This could even include server-side script
files that enable remote code execution.
Medium Article
Path traversal
Path traversal, also known as directory traversal, is a type of vulnerability that occurs when an
application fails to sanitize user input, allowing an attacker to access or modify files on the
server. This can lead to unauthorized access to sensitive data, such as configuration files, source
code, or even system files.
Medium Article
XML external entity (XXE) injection
XXE injection is a type of attack that targets applications parsing XML input. It happens when the
XML parser is configured to process external entities special references in XML that can load files
or fetch resources from remote servers.
Medium Article
Cross-Site Scripting (XSS) | PortSwigger’s Apprentice Labs | Labs 1–9 Walkthrough
Cross-site scripting (XSS) is a type of attack that targets applications that display user input
without proper validation or escaping. It allows an attacker to inject malicious scripts into a web
page, which can then be executed by other users.
