Exploitation

Business Logic Exploitation

Exploit flaws in application workflow, authentication bypass, price manipulation, and privilege escalation by abusing intended business logic rather than technical vulnerabilities.

Clickjacking

Exploiting UI redress attacks by overlaying transparent iframes to hijack user clicks, steal credentials, or trigger unauthorized actions on vulnerable web applications.

Command Injection Exploitation

Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, bypass techniques, and OS command execution through user-supplied input.

CORS Exploitation

Exploiting misconfigured CORS policies to bypass same-origin restrictions, steal credentials, and perform cross-origin requests using crafted malicious origins.

CRLF Injection

Exploiting CRLF injection to manipulate HTTP headers, inject malicious responses, perform response splitting, and achieve session hijacking or XSS attacks.

CSRF Exploitation

Exploit Cross-Site Request Forgery vulnerabilities to force authenticated users into executing unwanted actions via crafted malicious HTTP requests.

CVE-2025-54068 Livewire RCE Exploitation

Exploits CVE-2025-54068, a critical Livewire RCE vulnerability via malicious component payloads over HTTP/HTTPS to achieve remote code execution.

Directory Traversal

Exploit path traversal vulnerabilities in web apps to access files outside the webroot using encoded sequences like ../to read sensitive system files.

DOM-Based XSS Exploitation

Exploit client-side DOM vulnerabilities by injecting malicious scripts into unsafe sinks via tainted sources, bypassing server-side filters in web applications.

File Inclusion Exploitation

Exploit Local and Remote File Inclusion vulnerabilities in web apps to read sensitive files, achieve RCE, and bypass filters via path traversal and log poisoning.

Git Repository Exploitation

Exploit exposed .git directories to reconstruct source code, extract credentials, and uncover sensitive application logic from misconfigured web servers.

GraphQL Exploitation

Exploit GraphQL APIs via introspection abuse, query batching, field stuffing, and injection attacks to extract data or escalate privileges.

Host Header Injection

Exploiting misconfigured HTTP Host headers to manipulate web app logic, bypass access controls, poison caches, and trigger SSRF or password reset vulnerabilities.

HTTP Parameter Pollution

Exploiting duplicate HTTP parameters to bypass WAFs, override values, and manipulate backend logic through inconsistent multi-layer parameter parsing.

IDOR Exploitation

Exploit Insecure Direct Object Reference vulnerabilities by manipulating parameter values to access unauthorised resources via HTTP requests.

Insecure Deserialization

Exploiting insecure deserialization over HTTP/HTTPS to achieve RCE, privilege escalation, or authentication bypass via crafted serialized payloads.

JavaScript for XSS

Core JavaScript concepts for crafting XSS payloads: DOM manipulation, event handlers, data exfiltration, and bypassing input sanitisation filters.

JWT Exploitation

Covers attacking JWT authentication flaws including signature bypass, algorithm confusion (none/RS256→HS256), weak secret cracking, and claim manipulation to escalate privileges.

Laravel Ignition Remote Code Execution - CVE-2021-3129

Exploiting CVE-2021-3129 in Laravel Ignition to achieve RCE via malicious log file deserialization through the debug mode endpoint.

NoSQL Injection

Exploit NoSQL databases via malformed queries, operator abuse, and authentication bypass targeting MongoDB, CouchDB, and similar non-relational backends.

PHP Type Juggling

Exploiting PHP's loose type comparison operators to bypass authentication and logic checks via unexpected type coercion behaviours.

Prototype Pollution

Exploiting prototype pollution vulnerabilities in JavaScript to manipulate object inheritance chains via HTTP, enabling privilege escalation and remote code execution.

Race Condition Exploitation

Exploit time-of-check to time-of-use (TOCTOU) flaws in web apps via concurrent HTTP requests to bypass auth, duplicate transactions, or escalate privileges.

React2Shell - CVE-2025-55182 + CVE-2025-66478