Exploiting LLM APIs with excessive agency - APPRENTICE
AmirHossein Soltani
Exploiting LLM APIs with excessive agency - APPRENTICE
4:09
Exploiting an API endpoint using documentation - APPRENTICE
AmirHossein Soltani
Exploiting an API endpoint using documentation - APPRENTICE
4:06
Exploiting NoSQL operator injection to bypass authentication - APPRENTICE
AmirHossein Soltani
Exploiting NoSQL operator injection to bypass authentication - APPRENTICE
2:29
Detecting NoSQL injection - APPRENTICE
AmirHossein Soltani
Detecting NoSQL injection - APPRENTICE
1:14
Limit overrun race conditions - APPRENTICE
AmirHossein Soltani
Limit overrun race conditions - APPRENTICE
6:30
Accessing private GraphQL posts - APPRENTICE
AmirHossein Soltani
Accessing private GraphQL posts - APPRENTICE
3:59
Remote code execution via server-side prototype pollution - PRACTITIONER
AmirHossein Soltani
Remote code execution via server-side prototype pollution - PRACTITIONER
4:41
Bypassing flawed input filters for server-side prototype pollution - PRACTITIONER
AmirHossein Soltani
Bypassing flawed input filters for server-side prototype pollution - PRACTITIONER
1:50
Detecting server-side prototype pollution without polluted property reflection - PRACTITIONER
AmirHossein Soltani
Detecting server-side prototype pollution without polluted property reflection - PRACTITIONER
2:07
Privilege escalation via server-side prototype pollution - PRACTITIONER
AmirHossein Soltani
Privilege escalation via server-side prototype pollution - PRACTITIONER
5:57
Client-side prototype pollution in third-party libraries - PRACTITIONER
AmirHossein Soltani
Client-side prototype pollution in third-party libraries - PRACTITIONER
0:52
Client-side prototype pollution via flawed sanitization - PRACTITIONER
AmirHossein Soltani
Client-side prototype pollution via flawed sanitization - PRACTITIONER
5:19
DOM XSS via an alternative prototype pollution vector - Prototype pollution
AmirHossein Soltani
DOM XSS via an alternative prototype pollution vector - Prototype pollution
4:49
DOM XSS via client-side prototype pollution - PRACTITIONER
AmirHossein Soltani
DOM XSS via client-side prototype pollution - PRACTITIONER
2:54
Client-side prototype pollution via browser APIs - PRACTITIONER
AmirHossein Soltani
Client-side prototype pollution via browser APIs - PRACTITIONER
3:29
Scanning non-standard data structures - PRACTITIONER
AmirHossein Soltani
Scanning non-standard data structures - PRACTITIONER
14:27
Discovering vulnerabilities quickly with targeted scanning - PRACTITIONER
AmirHossein Soltani
Discovering vulnerabilities quickly with targeted scanning - PRACTITIONER
3:11
JWT authentication bypass via flawed signature verification - APPRENTICE
AmirHossein Soltani
JWT authentication bypass via flawed signature verification - APPRENTICE
2:47
JWT authentication bypass via unverified signature - APPRENTICE
AmirHossein Soltani
JWT authentication bypass via unverified signature - APPRENTICE
3:51
Web shell upload via Content-Type restriction bypass - APPRENTICE
AmirHossein Soltani
Web shell upload via Content-Type restriction bypass - APPRENTICE
2:37
Remote code execution via web shell upload - APPRENTICE
AmirHossein Soltani
Remote code execution via web shell upload - APPRENTICE
2:18
Authentication bypass via OAuth implicit flow - APPRENTICE
AmirHossein Soltani
Authentication bypass via OAuth implicit flow - APPRENTICE
1:30
Host header authentication bypass - APPRENTICE
AmirHossein Soltani
Host header authentication bypass - APPRENTICE
1:23
Basic password reset poisoning - APPRENTICE
AmirHossein Soltani
Basic password reset poisoning - APPRENTICE
4:55
URL normalization - PRACTITIONER
AmirHossein Soltani
URL normalization - PRACTITIONER
1:17
Web cache poisoning via a fat GET request - PRACTITIONER
AmirHossein Soltani
Web cache poisoning via a fat GET request - PRACTITIONER
2:52
Parameter cloaking - PRACTITIONER
AmirHossein Soltani
Parameter cloaking - PRACTITIONER
2:09
Web cache poisoning via an unkeyed query parameter - PRACTITIONER
AmirHossein Soltani
Web cache poisoning via an unkeyed query parameter - PRACTITIONER
1:45
Web cache poisoning via an unkeyed query string - PRACTITIONER
AmirHossein Soltani
Web cache poisoning via an unkeyed query string - PRACTITIONER
1:25
Targeted web cache poisoning using an unknown header - PRACTITIONER
AmirHossein Soltani
Targeted web cache poisoning using an unknown header - PRACTITIONER
7:16
Web cache poisoning with multiple headers - PRACTITIONER
AmirHossein Soltani
Web cache poisoning with multiple headers - PRACTITIONER
7:32
Web cache poisoning with an unkeyed cookie - PRACTITIONER
AmirHossein Soltani
Web cache poisoning with an unkeyed cookie - PRACTITIONER
4:14
Web cache poisoning with an unkeyed header - PRACTITIONER
AmirHossein Soltani
Web cache poisoning with an unkeyed header - PRACTITIONER
5:26
Flawed enforcement of business rules - APPRENTICE
AmirHossein Soltani
Flawed enforcement of business rules - APPRENTICE
4:10
Inconsistent security controls - APPRENTICE
AmirHossein Soltani
Inconsistent security controls - APPRENTICE
4:33
Excessive trust in client-side controls - APPRENTICE
AmirHossein Soltani
Excessive trust in client-side controls - APPRENTICE
2:13
Authentication bypass via information disclosure - APPRENTICE
AmirHossein Soltani
Authentication bypass via information disclosure - APPRENTICE
2:09
Source code disclosure via backup files - APPRENTICE
AmirHossein Soltani
Source code disclosure via backup files - APPRENTICE
1:18
Information disclosure on debug page - APPRENTICE
AmirHossein Soltani
Information disclosure on debug page - APPRENTICE
1:18
Information disclosure in error messages - APPRENTICE
AmirHossein Soltani
Information disclosure in error messages - APPRENTICE
0:58
Modifying serialized objects - APPRENTICE
AmirHossein Soltani
Modifying serialized objects - APPRENTICE
2:22
Manipulating WebSocket messages to exploit vulnerabilities - APPRENTICE
AmirHossein Soltani
Manipulating WebSocket messages to exploit vulnerabilities - APPRENTICE
1:25
Password reset broken logic - APPRENTICE
AmirHossein Soltani
Password reset broken logic - APPRENTICE
2:56
2FA simple bypass - APPRENTICE
AmirHossein Soltani
2FA simple bypass - APPRENTICE
1:22
Username enumeration via different responses - APPRENTICE
AmirHossein Soltani
Username enumeration via different responses - APPRENTICE
2:17
Insecure direct object references - APPRENTICE
AmirHossein Soltani
Insecure direct object references - APPRENTICE
2:11
User ID controlled by request parameter with password disclosure - APPRENTICE
AmirHossein Soltani
User ID controlled by request parameter with password disclosure - APPRENTICE
2:01
User ID controlled by request parameter with data leakage in redirect - APPRENTICE
AmirHossein Soltani
User ID controlled by request parameter with data leakage in redirect - APPRENTICE
1:44
User ID controlled by request parameter, with unpredictable user IDs - APPRENTICE
AmirHossein Soltani
User ID controlled by request parameter, with unpredictable user IDs - APPRENTICE
1:12
User ID controlled by request parameter - APPRENTICE
AmirHossein Soltani
User ID controlled by request parameter - APPRENTICE
1:53
User role can be modified in user profile - APPRENTICE
AmirHossein Soltani
User role can be modified in user profile - APPRENTICE
1:08
User role controlled by request parameter - APPRENTICE
AmirHossein Soltani
User role controlled by request parameter - APPRENTICE
0:57
Unprotected admin functionality with unpredictable URL - APPRENTICE
AmirHossein Soltani
Unprotected admin functionality with unpredictable URL - APPRENTICE
0:53
Unprotected admin functionality - APPRENTICE
AmirHossein Soltani
Unprotected admin functionality - APPRENTICE
0:24
Server-side template injection with information disclosure via user-supplied objects - PRACTITIONER
AmirHossein Soltani
Server-side template injection with information disclosure via user-supplied objects - PRACTITIONER
3:14
Server-side template injection in an unknown language with a documented exploit - PRACTITIONER
AmirHossein Soltani
Server-side template injection in an unknown language with a documented exploit - PRACTITIONER
1:00
Server-side template injection using documentation - PRACTITIONER
AmirHossein Soltani
Server-side template injection using documentation - PRACTITIONER
1:12
Basic server-side template injection (code context) - PRACTITIONER
AmirHossein Soltani
Basic server-side template injection (code context) - PRACTITIONER
3:07
Basic server-side template injection - PRACTITIONER
AmirHossein Soltani
Basic server-side template injection - PRACTITIONER
3:32
File path traversal simple case - APPRENTICE
AmirHossein Soltani
File path traversal simple case - APPRENTICE
0:47
OS command injection, simple case - APPRENTICE
AmirHossein Soltani
OS command injection, simple case - APPRENTICE
1:19
Basic SSRF against another back-end system - APPRENTICE
AmirHossein Soltani
Basic SSRF against another back-end system - APPRENTICE
3:30
Basic SSRF against the local server - APPRENTICE
AmirHossein Soltani
Basic SSRF against the local server - APPRENTICE
1:24
Exploiting XXE to perform SSRF attacks - APPRENTICE
AmirHossein Soltani
Exploiting XXE to perform SSRF attacks - APPRENTICE
3:06
Exploiting XXE using external entities to retrieve files - APPRENTICE
AmirHossein Soltani
Exploiting XXE using external entities to retrieve files - APPRENTICE
1:58
CORS vulnerability with trusted null origin - APPRENTICE
AmirHossein Soltani
CORS vulnerability with trusted null origin - APPRENTICE
5:27
CORS vulnerability with basic origin reflection - APPRENTICE
AmirHossein Soltani
CORS vulnerability with basic origin reflection - APPRENTICE
4:14
DOM-based cookie manipulation - PRACTITIONER
AmirHossein Soltani
DOM-based cookie manipulation - PRACTITIONER
2:31
DOM-based open redirection - PRACTITIONER
AmirHossein Soltani
DOM-based open redirection - PRACTITIONER
4:17
DOM XSS using web messages and JSON.parse - PRACTITIONER
AmirHossein Soltani
DOM XSS using web messages and JSON.parse - PRACTITIONER
1:42
DOM XSS using web messages and a JavaScript URL - PRACTITIONER
AmirHossein Soltani
DOM XSS using web messages and a JavaScript URL - PRACTITIONER
1:15
DOM XSS using web messages - PRACTITIONER
AmirHossein Soltani
DOM XSS using web messages - PRACTITIONER
1:14
Clickjacking with a frame buster script - APPRENTICE
AmirHossein Soltani
Clickjacking with a frame buster script - APPRENTICE
4:08
Clickjacking with form input data prefilled from a URL parameter - APPRENTICE
AmirHossein Soltani
Clickjacking with form input data prefilled from a URL parameter - APPRENTICE
2:19
Basic clickjacking with CSRF token protection - APPRENTICE
AmirHossein Soltani
Basic clickjacking with CSRF token protection - APPRENTICE
2:38
CSRF vulnerability with no defenses - APPRENTICE
AmirHossein Soltani
CSRF vulnerability with no defenses - APPRENTICE
2:58
Reflected XSS into a JavaScript string with angle brackets HTML encoded - APPRENTICE
AmirHossein Soltani
Reflected XSS into a JavaScript string with angle brackets HTML encoded - APPRENTICE
0:54
Stored XSS into anchor href attribute with double quotes HTML-encoded - APPRENTICE
AmirHossein Soltani
Stored XSS into anchor href attribute with double quotes HTML-encoded - APPRENTICE
2:46
Reflected XSS into attribute with angle brackets HTML-encoded #7 - APPRENTICE
AmirHossein Soltani
Reflected XSS into attribute with angle brackets HTML-encoded #7 - APPRENTICE
1:30
DOM XSS in jQuery selector sink using a hashchange event #6 - APPRENTICE
AmirHossein Soltani
DOM XSS in jQuery selector sink using a hashchange event #6 - APPRENTICE
2:01
DOM XSS in jQuery anchor href attribute sink using location.search source #5 - APPRENTICE
AmirHossein Soltani
DOM XSS in jQuery anchor href attribute sink using location.search source #5 - APPRENTICE
1:32
DOM XSS in innerHTML sink using source location.search #4 - APPRENTICE
AmirHossein Soltani
DOM XSS in innerHTML sink using source location.search #4 - APPRENTICE
0:37
DOM XSS in document.write sink using source location.search #3 - APPRENTICE
AmirHossein Soltani
DOM XSS in document.write sink using source location.search #3 - APPRENTICE
1:28
Stored XSS into HTML context with nothing encoded #2 - APPRENTICE
AmirHossein Soltani
Stored XSS into HTML context with nothing encoded #2 - APPRENTICE
0:55
Reflected XSS into HTML context with nothing encoded #1 - APPRENTICE
AmirHossein Soltani
Reflected XSS into HTML context with nothing encoded #1 - APPRENTICE
0:33
SQL injection vulnerability allowing login bypass #2 - APPRENTICE
AmirHossein Soltani
SQL injection vulnerability allowing login bypass #2 - APPRENTICE
0:23
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data #1 - APPRENTICE
AmirHossein Soltani
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data #1 - APPRENTICE
0:59