NegativeWibes

                      Lets first disccuss about the what is Web Cache and why it used? Web cache: A Web cache (or HTTP cache) is an information technology for the temporary storage (caching) of Web documents, such as Web pages, images, and other types of Web multimedia, to reduce server lag. WHY IT IS USED? When you visit a website, you don’t just need to retrieve the content of the page you’re seeing — you also need a bunch of resources such as JavaScript files, stylesheets, and fonts and so on, which your browser downloads in addition to the content of the page. Browser caching allows your browser to store these files for a while, so it doesn’t need to retrieve them every time you visit the site. The first time you visit this site (WinningWP.com), for example, you’ll receive a bunch of resources that your browser will immediately cache. This first will likely take a few seconds to completely download...

Hey Guyes today i found a vulnerability of  user information leakage due to improper auth token implementation in application. DESCRIPTION: some applications  mask user informaion like mail id , phone no , adhar card, pain card or any personal information of use for  user privacy. but due to some loop holes an attacker can see masked user information. LETS CONTINUE HOW I FOUND :- ➤ 1.       Login in application 2.        Click on deals and capture that request in burpsuite 3.       Send that request in repeater tab check response 4.        Now logout account check response same response appeared. 5.    I tried to check with old auth token then also same response received Phone number and mails are not showing in response⦽ 1.       I tried to bruteforce deals id 2.    ...

A brute force attack is a popular cracking method: by some accounts, brute force attacks accounted for five percent of confirmed security breaches. A brute force attack involves ‘guessing’ username and passwords to gain unauthorized access to a system. Brute force is a simple attack method and has a high success rate   . Hey guyes today I will tell you how I bypass misconfigured rate limiting protection and from this   victim account can be hijacked by bruteforcing the password . LETS DESCRIBE :      An application like  xyz.com implemented rate limiting protection on login page  on basis  of ip.        If any user hit login request 25 times repeatedly then their ip will be blocked for next 10 or 12 seconds.       So I created a  python  script to handle this automatically: import requests import os import time global pastebin_url import sys if len(sys.argv) == 2: filename = sy...