1 Top 10 Volunerabilities

1 Top 10 Volunerabilities

exploit a pentetest framework

XSS - Cross Site Scripting

  • put js to form
  • Beef framework


  • protect endpoints

XXE - Xml EXternal Entity


  • disable DTD

File Injection

charles a request monitoring tool and modification

demo a cshtml example
if website keep the file name at the same time, like Views/Upload/Cat.jpg
with /images/Views/Upload/x.cshtml


  • do not persist user supplied name
  • do not serve directly
  • do serve off alternate domain / s3 bucket / usercontent.xxx.com

SQLi SQL Injection

  • no sqldoes not mean no SQLi
  • tool sqlmap


  • ORM
  • direct SQL, parameterize