Hacking my way

Hey guys, so I am back with a new post this time. Recently I was assigned a penetration test for a certain client. I have written another post on my CSRF  findings in this penetration test. If you haven't read that post, I  recommend checking it out here , so that you can understand the application flow and how a user can interact with the ADMIN. I don't want to make it a long post by repeating the same things I did in the last post.                            Let's get to the main point then. In the application, the ADMIN can invite a user who would then sign up through that link. The main thing  I noticed here, was that this user could also, update the settings page for the company. He could change the company name also. The company name was being reflected on the page and I immediately thought that it seems a perfect place for finding XSS vulnerabilities. So I started trying different XSS payloads there, but it was filtering most of the stuff I could think of. If  I

Hi, guys so this is something which I found during a penetration test and though its nothing too special, I thought why not share with you guys, because # Sharing is Caring . So this is how this story goes :)                                                           Recently I was conducting a penetration test for a company and say the target was  www. xyz .com.  Now, to be honest, the application was full of vulnerabilities but yes, I do love finding XSS and CSRF bugs (because I am a noob ;)) And, I did get a couple of  XSS's in quick successions ( more on this in another post). The target www.xyz.com  was an adverting platform, and people signing up normally would be considered as Master Admin of the team. These Master Admins can then invite other users as  Admins or normal users to the team. There was also the functionality to change the team's name and other settings. The first user i.e. the Master Admin could delete the account of other invited users (both roles, A