Posts by pretera

Account takeover by password reset is a common yet often overlooked flaw in which an attacker acquires access to a victim’s account by manipulating the password reset process. This type of flaw frequently targets flaws in how a website or service handles callback URLs, which are intended to redirect users after they reset their passwords.…

Often overlooked, social engineering has always been a great weapon for cybercriminals due to its focus on exploiting human weaknesses. Social engineering takes a different approach compared to traditional hacking: instead of focusing on exploiting software vulnerabilities, it seeks to manipulate human weaknesses. It relies on manipulating emotions like trust, fear, and respect for authority,…

Since I recently passed the “Burp Suite Certified Practitioner” exam, I felt it would be useful to share some of my experiences and lessons learned, with those who are considering taking this exam, or just interested in completing the PortSwigger Academy challenges. How Did I Prepare Despite the fact that I have spent several years…

Recently, we were given the mission to conduct an internal and wireless security assessment for one of our clients. Following the discovery of vulnerabilities in their network security and the acquisition of access to their wireless infrastructure, we were able to carry out remote network scanning of their internal systems. After enumerating their running services…

Penetration testing, also known as pentesting, is a simulated cyber attack on a computer system, network, or web application with the goal of finding security vulnerabilities that could be exploited by malicious hackers. In today’s rapidly evolving digital world, pentesting has become a critical component of any organization’s security strategy. In this blog post, we…