Posts | Classroom

TryHackMe Web Frameworks Code Review: source-to-sink Flask audit

code review

Web Frameworks Code Review: source-to-sink Flask audit

TryHackMe El Bandito: H2.CL desync to steal bot credentials

HTTP request smuggling

El Bandito: H2.CL desync to steal bot credentials

TryHackMe HTTP Browser Desync: client-side smuggling via Werkzeug

HTTP request smuggling

HTTP Browser Desync: client-side smuggling via Werkzeug

TryHackMe WebSocket Request Smuggling: proxy bypass via fake upgrades

WebSocket smuggling

WebSocket Request Smuggling: proxy bypass via fake upgrades

TryHackMe HTTP/2 Request Smuggling: CRLF injection and cache poisoning

HTTP/2

HTTP/2 Request Smuggling: CRLF injection and cache poisoning

TryHackMe HTTP Request Smuggling: CL.TE desync exploitation

HTTP request smuggling

HTTP Request Smuggling: CL.TE desync exploitation

TryHackMe CORS and SOP: cross-origin data exfiltration

CORS

CORS and SOP: cross-origin data exfiltration

TryHackMe DOM-Based Attacks: stored XSS via Vue v-html exploitation

DOM-based XSS

DOM-Based Attacks: stored XSS via Vue v-html exploitation

TryHackMe CSRF: token bypass and SameSite cookie exploitation

CSRF

CSRF: token bypass and SameSite cookie exploitation

TryHackMe XSS: reflected, stored, and DOM-based scripting attacks

cross-site scripting

XSS: reflected, stored, and DOM-based scripting attacks