Setting Up Web App Penetration Testing Lab Using ThreadsApp
Introduction With the sheer number of cyber threats which occur everyday, a lot of individuals want to tackle that and to be on the good side. But one main question …
Markdown For Penetration testers & Bug-bounty hunters
why is Markdown For Penetration testers & Bug-bounty hunters Our guide “Markdown For Penetration testers & Bug-bounty hunters” will make this clear. why markdown is so cool for writing reports …
Finding and exploiting Blind XSS
If you are here, we are already presuming that you know what XSS is and the major types of XSS(i.e Reflected and Stored). Plus there is DOM-based XSS too which …
Doing RECON the correct way
Hey guys, today we will discuss Information gathering aka Recon which is the foundation of every bug bounties or penetration tests which you will ever do. Many security researchers have …
A User can change the personal details of any other user broken access control
Broken Access Control Hi everyone. Welcome to this new post from ENCIPHERS. So recently, our team at ENCIPHERS conducted a penetration test for a certain company. The company is a …
Knoxss vs Burpsuite(A practical Demonstration)
Knoxss vs Burpsuite Hello guys. So this is going to be an interesting blog as we are going to watch a practical demonstration of two awesome tools in the penetration …
How can Expired URLs lead to an all-new kind of vulnerability?
Hey guys. Actually, this is the 2nd part of the vulnerability which we discussed in the earlier post. You can read that post from here. Now if you read the …
Bypassing Cloudflare WAF to get more vulnerabilities
Bypassing WAF (Web Application Firewall) Hey guys, If you have been doing penetration testing or bug bounties for some time now, then you must have come across applications which uses …
IDOR to change the email notifications of user
IDOR Hey guys. Welcome to this new post from ENCIPHERS. Recently we have been writing a lot about bypass of different access controls and in the recent pentest conducted by …
Doing Subdomain Enumeration the right way
Hey guys. Welcome to this new post from ENCIPHERS. For the last few months, we have been continuously writing about different Findings and the approach our team took to find …
Bypassing Access Control to see the private videos of a user
Hello security professionals. In the last post, we talked about the XSS finding in the recent penetration test conducted by our company ENCIPHERS. Here is a link to that post. …
How self XSS got turned into a stored XSS?
self XSS Hey everyone. Our company ENCIPHERS recently conducted a penetration test for a certain client XYZ and in this post, we will be sharing my XSS finding which was …
