Vaadata’s Blog - Website and mobile app security

Technical September 18, 2023

Insecure Authentication Tokens leading to Account Takeover

Most applications have a critical feature for identifying users. The aim is to guarantee the confidentiality and integrity of their data. Common methods used to enable the server to identify a user include session cookies, JSON Web Tokens (JWT) or, in some cases, customised solutions.

Clearly, the logic behind the generation of these session tokens is essential, because bypassing or hijacking them can lead to account takeover, with critical impacts on data security and even the total compromise of the system.

Technical September 13, 2023

Introduction to Exegol, an Environment Dedicated to Offensive Security

Solutions August 18, 2023

Internal Penetration Testing: Objective, Methodology, Black Box and Grey Box Tests

Faced with an ever-increasing number of internal attacks, network infrastructure security is a key factor in ensuring the confidentiality and integrity of data, as well as the continuity of an organization’s activities.

There are several ways of assessing the security of an internal network. In this article, we present the “offensive” approach, which we believe to be the most effective: internal penetration testing. We detail the principles and objectives, as well as use cases for black box and grey box penetration testing of an internal network.

Technical August 7, 2023

Exploiting an LFI (Local File Inclusion) Vulnerability and Security Tips

When we visit a website, it is common to be able to browse different pages. Each page can be represented by a file on the server. In order to determine which file to provide, the application needs the client to specify which file it is interested in. To do this, sometimes the page the user wants is present in a request parameter.

Solutions August 1, 2023

Web Application Penetration Testing: Objective, Methodology, Black Box, Grey Box and White Box Tests

Faced with an ever-increasing number of sophisticated attacks, web application security is a major challenge. Indeed, security is now crucial to reassure customers, build loyalty and convert prospects.

There are several ways of assessing the security of a web application. In this article, we present the “offensive” approach, which we believe to be the most effective: web application penetration testing. We detail the principles and objectives, as well as use cases for black box, grey box and white box penetration tests on various targets.

Technical June 15, 2023

What is Mass Assignment? Attacks and Security Tips

What is a Mass Assignment vulnerability?

To make things easier for developers, many frameworks include features that automatically associate the parameters of an HTTP request with variables linked to an object in the application code.

A Mass Assignment vulnerability occurs when the server does not correctly filter the data transmitted by the user and associates it directly with an object without verification.

Solutions May 20, 2023

Data Encryption and Cryptographic Failures: OWASP Top 10 #2

In a previous article, we reviewed the most critical and widespread vulnerability in web applications according to the OWASP Top 10: broken access control. Today, we tackle the common vulnerabilities and exploits related to the lack or absence of encryption in applications.

Technical April 18, 2023

White box audit of a CI/CD pipeline on AWS

Recently, one of our clients asked us to review their Continuous Integration and Continuous Deployment (CI/CD) pipeline, deployed on an AWS infrastructure.

In this article, we will show how a developer with limited access to GitLab could have escalated his privileges and gained access to sensitive information to take control of the AWS infrastructure and cause significant damage to the organisation. We will also detail good practices and measures to implement to counter this type of risk.

Technical April 13, 2023

How to update passwords in database to secure their storage with Argon2?

In a previous article, we saw why it was important to store passwords in a database with robust hash functions such as Bcrypt and Argon2. This helps to render brute force or dictionary attacks completely ineffective.

However, a problem is regularly noted on already existing applications: how to use the latest recommendations on password storage on an existing database?

Technical April 12, 2023

What is Session Hijacking? Types of attacks and exploitations

Access control is a central element in ensuring the security of web applications. It must be based on robust authentication and session management that takes into account various security risks, such as session hijacking.

XSS exploitation, session fixation, lack of encryption, MFA bypass, etc., there are many techniques to hijack a user’s session. In this article, we present the main attacks and exploits.

Solutions March 31, 2023

OWASP Top 10 #1: Broken Access Control And Security Tips

The Open Web Application Security Project (OWASP) is a community working to improve the security of information systems and more specifically applications (web, mobile, APIs).

This organisation produces numerous resources, in particular guides and standards for application security, including the OWASP Top 10. It also develops open source tools such as ZAP (an interception proxy, an alternative to BURP), or Amass (to map its attack surface).

Technical February 21, 2023

Exploiting an HTML injection with dangling markup

During a web application penetration test, we came across the following situation:

Solutions February 15, 2023

Multifactor Authentication (MFA) : how does it work? Types of attacks, exploits and security best practices

Multifactor authentication (MFA) is a central and widely used mechanism for strengthening the security of user accounts and access to a system.

Indeed, it is an authentication method that prevents many malicious attacks and exploits aimed at compromising data: brute force, session hijacking, privilege escalation, etc.