NegativeWibes

                      Lets first disccuss about the what is Web Cache and why it used? Web cache: A Web cache (or HTTP cache) is an information technology for the temporary storage (caching) of Web documents, such as Web pages, images, and other types of Web multimedia, to reduce server lag. WHY IT IS USED? When you visit a website, you don’t just need to retrieve the content of the page you’re seeing — you also need a bunch of resources such as JavaScript files, stylesheets, and fonts and so on, which your browser downloads in addition to the content of the page. Browser caching allows your browser to store these files for a while, so it doesn’t need to retrieve them every time you visit the site. The first time you visit this site (WinningWP.com), for example, you’ll receive a bunch of resources that your browser will immediately cache. This first will likely take a few seconds to completely download...

Hey Guyes today i found a vulnerability of  user information leakage due to improper auth token implementation in application. DESCRIPTION: some applications  mask user informaion like mail id , phone no , adhar card, pain card or any personal information of use for  user privacy. but due to some loop holes an attacker can see masked user information. LETS CONTINUE HOW I FOUND :- ➤ 1.       Login in application 2.        Click on deals and capture that request in burpsuite 3.       Send that request in repeater tab check response 4.        Now logout account check response same response appeared. 5.    I tried to check with old auth token then also same response received Phone number and mails are not showing in response⦽ 1.       I tried to bruteforce deals id 2.    ...

A brute force attack is a popular cracking method: by some accounts, brute force attacks accounted for five percent of confirmed security breaches. A brute force attack involves ‘guessing’ username and passwords to gain unauthorized access to a system. Brute force is a simple attack method and has a high success rate   . Hey guyes today I will tell you how I bypass misconfigured rate limiting protection and from this   victim account can be hijacked by bruteforcing the password . LETS DESCRIBE :      An application like  xyz.com implemented rate limiting protection on login page  on basis  of ip.        If any user hit login request 25 times repeatedly then their ip will be blocked for next 10 or 12 seconds.       So I created a  python  script to handle this automatically: import requests import os import time global pastebin_url import sys if len(sys.argv) == 2: filename = sy...

                      The StrandHogg vulnerability (Task Hijacking) Promon security researchers have found proof of a dangerous Android vulnerability, dubbed ‘StrandHogg’, that allows real-life malware to pose as legitimate apps, with users unaware they are being targeted. First of all we started with basic knowledge of Activities  and task in android . You know very well  ANDROID SYSTEM IS MULTITASKING SYSTE M                                                       WHAT IS TASK IN Android? Task is collection of actiivites in android . like for example: you opened a gmail application . inbox activity is opened , now you click on message , a new activity is opened . now, there are two activities but , collection of these activities  is called task.  Activiti...

why the previous version devices are working?  Previous versions devices like : Kitkat,Lolipop allow  Android  to trusts user or admin supplied CA certificates. Means In Old versions Android  trust both user or root certificate. So, In Older Devices You have to only  install   burp certificate , and you can capture android application traffic , but In Newer version it is not possible. For Capturing traffic on newer version device  , requirements are given below: 1 . device must be rooted. You can us magisk or any other method to root the device. but for my point of view  magisk is best one.   https://www.thecustomdroid.com/install-magisk-root-android-devices/ You know very well that Newer Version device only trust root certificate not trust user certificate. so we have to put our certificate in root certificate . 1. install the certificate. (defaultly certficate  as user certificate )  path: /data/misc/us...

Short Description about CORS An HTML5 cross-origin resource sharing (CORS) policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of the request. Trusting arbitrary origins effectively disables the same-origin policy, allowing two-way interaction by third-party web sites. Unless the response consists only of unprotected public content, this policy is likely to present a security risk. If the site specifies the header Access-Control-Allow-Credentials: true, third-party sites may be able to carry out privileged actions and retrieve sensitive information. Even if it does not, attackers may be able to bypass any IP-based access controls by proxying through users' browsers. How to Verify CORS Misconfiguration (If any application using the API their Possibilities of CORS Exist) Case...

Hello Guys , today I'm gonna teach you  pass code /pin protection bypass in android application. that is applied in android application to authenticate in application. 1 . WHAT IS PIN PROTECTION AND WHY IS APPLIED ? _____________________________________________________________________ ____________ Pin protection is 4 digit pin  that  implemented on android application start/resume activity  (on every start/resume activity  first pin activity started after supplying right pin user is authenticated).Pin Protection is applied to secure the account from unauthorized use. For Example: S omeone finds your lost phone, or lost your phone and if phone is unlocked. then without pin protection that person access your any application and can do whatever he want.so  pin protection  a new layer of security in which application ask  4 digit pin to authenticate  user. WHERE PIN PROTECTION IS APPLIED? _______________...