Blog
InfluxDB 1.x ships with auth disabled — unauthenticated HTTP API access, API token discovery, Flux query injection, Telegraf credential exposure, bucket enumeration, and time-series data exfiltration techniques.
Read →ServiceNow misconfigurations exposed thousands of orgs in 2022. Covers ACL bypass, unauthenticated table API, guest user exploitation, credential exposure in sys_properties, scripted REST API bypass, and Integration Hub attacks.
Read →Exchange is the crown jewel of corporate communications. Covers ProxyLogon (CVE-2021-26855), ProxyShell (CVE-2021-34473), OWA brute force, EWS API impersonation, autodiscover credential leakage, and web shell detection.
Read →Salesforce holds the most sensitive enterprise data. Covers SOQL injection, REST/SOAP API permission misconfiguration, Connected App OAuth token abuse, Field-Level Security bypass, sharing rule exploitation, and guest user access vulnerabilities.
Read →Jira holds your roadmaps, credentials, and CI/CD integrations. Covers CVE-2022-0540 authentication bypass (CVSS 9.8), REST API token enumeration, project visibility misconfiguration, webhook SSRF, and Jira Data Center cluster attacks.
Read →How to find and exploit insecure window.postMessage() handlers. Covers missing origin validation, DOM-based XSS via message data, OAuth token leakage through wildcard targetOrigin, and postMessage-driven open redirects.
Read →Complete guide to JWT algorithm confusion vulnerabilities. Covers RS256-to-HS256 key confusion, alg:none bypass, JWK header injection, jku SSRF, kid SQL injection, and weak HMAC secret cracking with jwt_tool.
Read →How to find and test undocumented APIs. Covers JavaScript endpoint extraction, API version enumeration, framework debug endpoints (Spring Actuator), mobile app decompilation, and testing shadow APIs for broken authentication and BOLA.
Read →How to find and exploit ReDoS vulnerabilities in web applications. Covers catastrophic backtracking mechanics, identifying vulnerable patterns, black-box testing methodology, and language-specific remediation.
Read →How to test mutual TLS implementations for optional client auth, certificate validation bypasses, identity-not-used-for-authorization, header injection, and service mesh policy gaps in microservices and zero-trust deployments.
Read →How to test HTTP/2 and HTTP/3 implementations. Covers H2.CL and H2.TE request smuggling, HPACK compression attacks, CRLF injection via binary header values, server push cache poisoning, and Rapid Reset (CVE-2023-44487).
Read →Security testing guide for WebRTC applications. Covers internal IP address leakage via ICE candidates, TURN server open relay abuse, SDP injection through signaling layers, DTLS configuration weaknesses, and data channel security.
Read →How to security test browser extensions. Covers manifest permission auditing, content script XSS to background privilege escalation, insecure message passing, sensitive data storage, and native messaging host vulnerabilities.
Read →How to security test webhook implementations. Covers SSRF via webhook URL registration, HMAC signature validation bypass, replay attacks, event injection, and securing outbound webhook deliveries.
Read →How to audit browser storage mechanisms. Covers sensitive data in localStorage and IndexedDB, cookie security attributes (HttpOnly, SameSite, Secure), XSS exfiltration, cookie tossing via subdomains, and postMessage storage bridges.
Read →Security testing for PWAs. Covers service worker cache poisoning, persistent XSS via service worker registration, push notification injection, offline data exposure, and web app manifest misconfiguration.
Read →How to test for CSS injection vulnerabilities. Covers attribute selector-based data exfiltration (CSRF token theft), CSS keylogger techniques, style hijacking for UI redressing, and bypassing CSP via CSS injection vectors.
Read →Security testing guide for WebAuthn and FIDO2 passkey implementations. Covers challenge validation, origin and RPID verification, sign counter enforcement, credential binding, and fallback authentication weaknesses.
Read →Complete guide to XPath injection vulnerabilities. Covers authentication bypass, Boolean-based blind detection, character-by-character data extraction using XPath functions, and out-of-band exfiltration via document() calls.
Read →Security testing guide for Electron desktop applications. Covers nodeIntegration vulnerabilities, XSS-to-RCE attack chains, context isolation bypass, IPC channel abuse, protocol handler injection, and insecure auto-update mechanisms.
Read →How to use the OWASP Application Security Verification Standard (ASVS) to structure security testing. Covers L1/L2/L3 levels, key control domains, and CI/CD integration.
Read →How to test database security from a web application penetration testing perspective. Covers SQL injection, default credentials, exposed ports, privilege escalation, and OOB data exfiltration.
Read →How to test Electron, .NET, and Java thick client applications. Covers network traffic interception, binary analysis, DLL hijacking, local credential storage, and auto-update channel attacks.
Read →SAST, DAST, and IAST each catch different vulnerability classes at different stages. How each works, what it misses, and how to layer them for realistic coverage without drowning in alerts.
Read →The complete Kali Linux web app testing toolkit — nmap, Nikto, Nuclei, sqlmap, ffuf, Burp Suite, Hydra, jwt_tool — and how to use them in a systematic assessment workflow.
Read →How to integrate authenticated DAST into GitHub Actions and GitLab CI. Covers where in the pipeline to scan, managing false positives, baseline comparison, and a four-level DevSecOps maturity model.
Read →Shift-left means finding vulnerabilities before they ship. Learn how to embed SAST, secrets scanning, DAST, and threat modeling into every stage of your software development lifecycle.
Read →A VDP gives external researchers a safe, legal channel to report vulnerabilities. Learn how to write safe harbor language, set up a disclosure inbox, triage reports, and eventually graduate to a bug bounty.
Read →Misconfigured cookies enable session hijacking, CSRF attacks, and XSS escalation. Learn how to test every cookie attribute — HttpOnly, Secure, SameSite, domain scope, and cookie prefixes.
Read →Password reset flows are a common source of account takeover. Learn how to test for weak tokens, host header injection that routes resets to attacker servers, race conditions, and response manipulation.
Read →User enumeration lets attackers confirm which accounts exist — the first step before credential stuffing or targeted phishing. Learn to test login, registration, password reset, and API endpoints for timing and response differences.
Read →CRLF injection lets attackers inject arbitrary HTTP headers, split responses to serve attacker-controlled content, poison cookies, and falsify audit logs. Learn how to test all surfaces with every encoding variant.
Read →Web cache deception tricks CDN caches into storing and serving authenticated user data to attackers. Learn how to identify cacheable authenticated endpoints, exploit URL path confusion, and test across Cloudflare, Fastly, Akamai, and CloudFront.
Read →HTTP Parameter Pollution exploits inconsistent handling of duplicate parameters across web frameworks. Learn how to bypass WAFs, override business logic, attack OAuth redirect_uri validation, and test body, query, and multipart parameters.
Read →DOM clobbering lets attackers inject HTML that overrides JavaScript globals and properties, enabling XSS in contexts where script injection is blocked. Learn how to find clobberable sinks, exploit nested clobbering patterns, and bypass DOMPurify.
Read →Postman isn't just for API development — it's a powerful security testing tool. Learn how to use collections, pre-request scripts, and test assertions to find authentication flaws, IDOR, injection vulnerabilities, and authorization bypasses.
Read →Semgrep is the most developer-friendly SAST tool available. Learn how to write custom security rules that catch vulnerabilities specific to your codebase — SQL injection, hardcoded secrets, unsafe deserialization, and more.
Read →SaaS applications have a unique security surface: multi-tenancy, third-party integrations, API-first architecture, and compliance requirements. Here's how to test all of it systematically.
Read →How to conduct penetration testing on Microsoft Azure environments. Covers Azure AD privilege escalation, storage account exposure, and managed identity abuse.
Read →How to conduct penetration testing on Google Cloud Platform. Covers IAM misconfigurations, GCS bucket exposure, service account abuse, and metadata server exploitation.
Read →How to test and audit HTTP security headers including CSP, HSTS, X-Frame-Options, and Permissions-Policy. What each header does and how misconfigured headers get exploited.
Read →How to find IDOR vulnerabilities through horizontal and vertical privilege escalation, API parameter manipulation, and UUID prediction.
Read →How to test for account takeover vulnerabilities including credential stuffing, password reset flaws, token predictability, and MFA bypass in ATO attack chains.
Read →A systematic methodology for reviewing source code for security bugs — SQL injection patterns, auth bypass, cryptographic weaknesses, and access control flaws. Includes Semgrep rules, grep patterns, and DevSecOps integration.
Read →How to test gRPC services for reflection enumeration, per-method authorization bypass, injection through protobuf fields, and TLS misconfiguration. With grpcurl, Evans, and Burp Suite workflows.
Read →Clear definitions, a full comparison table, compliance mapping (PCI DSS, SOC 2, ISO 27001, TIBER-EU), and a maturity model to decide what engagement type fits your organization — including where continuous DAST fits.
Read →Complete WordPress security testing methodology — WPScan enumeration, plugin CVE exploitation, XML-RPC multicall brute force, REST API privilege escalation, and hardening verification for WordPress deployments.
Read →What ISO 27001:2022 actually mandates for penetration testing and vulnerability assessments — Annex A 8.8 and 8.29, audit evidence requirements, and how to structure a testing program that satisfies the standard.
Read →Django ORM SQL injection escape hatches, Jinja2 SSTI to RCE, Flask SECRET_KEY session forgery, CSRF bypass patterns, pickle deserialization, and Django security settings verification.
Read →Response manipulation, OTP reuse, step skipping, and brute-forceable codes — the application-level vulnerabilities that let attackers bypass 2FA without touching the second factor.
Read →API gateway bypass, service-to-service auth weaknesses, Kubernetes RBAC, Istio mTLS misconfigurations, and SSRF as lateral movement — security testing for distributed microservices deployments.
Read →PCI DSS 4.0 requirements 6.4, 11.2, and 11.3 explained — what each mandates for DAST scanning, penetration testing frequency, payment page script integrity, and ASV scans.
Read →Nuclei's YAML template system lets you encode security checks as reusable, automatable tests. How to write matchers, extractors, multi-step flows, and application-specific vulnerability checks.
Read →A WAF that can be bypassed is worse than no WAF — it creates false confidence. Encoding evasion, HTTP parameter pollution, chunked transfer, and protocol-level tricks that attackers use against signature-based filters.
Read →Node.js has a distinct vulnerability profile — prototype pollution, ReDoS, Express middleware misconfigurations, and npm supply chain risks. What to test and how when the target runs on the JavaScript stack.
Read →How attackers exploit the HTTP Host header to hijack password reset links, poison web caches, and trigger SSRF — and how to test your application for these vulnerabilities.
Read →Blind XSS fires in admin dashboards, support tools, and back-office interfaces where you can't directly observe the output. Out-of-band detection, injection points, and remediation.
Read →Missing rate limiting enables credential stuffing, OTP brute force, scraping, and resource exhaustion. How to test rate limiting controls and the bypass techniques attackers actually use.
Read →Brute force protections, session token entropy, JWT attacks (alg:none, RS256→HS256 confusion), MFA bypass, password reset flaws, and what automated scanners actually detect.
Read →IDOR, privilege escalation, missing function-level controls, JWT manipulation — and why access control is the hardest category for automated tools to fully cover.
Read →What each approach finds, what it misses, how it integrates into CI/CD, and how to build a practical testing stack that covers your real attack surface.
Read →How SQL injection works, manual testing techniques (in-band, blind, time-based), automated detection, and parameterized query remediation.
Read →Reflected, stored, and DOM-based XSS — how each type works, how to test for it, and what remediation requires beyond "just encode output."
Read →DAST tests your running application from the outside, the way an attacker would. How it works, what it finds, and when to use it.
Read →They're often confused but serve very different purposes. When to use each, what they cost, and how they fit together in a mature security program.
Read →What Article 32 requires in practice, how regulators have enforced it, and what a defensible testing program looks like.
Read →What each OWASP Top 10 vulnerability actually is, how to test for it, and what automated scanning can and can't cover.
Read →From OWASP API Top 10 to JWT attacks and OAuth flaws — what's tested and why automated scanners miss most of it.
Read →How security scanning evolved from scripts to AI orchestration — and when you still need a human.
Read →Why running these tools in isolation leaves gaps, and how chaining them transforms results.
Read →Market overview, four unsolved problems, and where security scanning is heading.
Read →Why closed-source DAST engines undermine the verification principle that security is built on.
Read →Deep dive into nmap, nikto, nuclei, sqlmap, testssl, and whatweb — how they work together.
Read →Transparent feature, depth, and pricing comparison across the DAST market.
Read →How AI decision-making chains security tools like an experienced pentester would.
Read →What auditors actually look for and how to build a scanning program that passes.
Read →Where to place DAST in your pipeline, how to handle results without breaking developer flow, and what tooling choices actually matter.
Read →Default credentials, missing security headers, exposed admin interfaces, CORS misconfigurations, and verbose error handling — what automated scanners catch and what requires manual checks.
Read →Cloud metadata endpoint exfiltration, blind SSRF detection, filter bypass techniques, and why SSRF is especially dangerous in AWS, GCP, and Azure environments.
Read →Weak TLS configuration, insecure password hashing, cleartext data transmission, and sensitive data exposure — what automated scanners detect and where manual review is required.
Read →Business logic flaws, missing rate limiting, workflow bypass, and trust boundary violations — design-level weaknesses that can't be patched away and are rarely caught by automated scanners.
Read →Version fingerprinting, CVE mapping, client-side library scanning, and how to assess actual exploitability — why attackers love unpatched components and how to find them before they do.
Read →Insecure deserialization, missing Subresource Integrity, unsafe YAML parsing, and CI/CD pipeline injection — supply chain attacks start with integrity assumptions you haven't verified.
Read →Missing audit trails, log injection vulnerabilities, sensitive data in logs, and alerting coverage gaps — the category that lets every other attack go undetected for months.
Read →No AppSec program? Here's a realistic 90-day roadmap for building application security at a mid-market company — from baseline assessment to automated scanning and metrics.
Read →CVSS measures potential severity, not actual risk. How to combine Base Score, EPSS, exposure, and data sensitivity to build a prioritization framework that actually works.
Read →Containers introduce new attack surfaces that DAST doesn't cover. Image scanning, runtime configuration, Kubernetes RBAC, and network policies — what to scan and how.
Read →alg:none attacks, algorithm confusion, weak secrets, kid injection, and claim manipulation — a practical guide to testing JWT implementations the way pentesters do.
Read →Reflected origins, null origin abuse, overly broad regex, and HTTPS downgrade — six CORS misconfiguration types, how to test each with curl, and how to fix them.
Read →Negative quantities, workflow sequence attacks, race conditions, mass assignment — why business logic flaws can't be found automatically and how to test for them manually.
Read →Introspection abuse, injection via queries, broken authorization at field and object level, batching attacks, and what automated scanners miss in GraphQL APIs.
Read →Redirect URI manipulation, CSRF via missing state, authorization code reuse, PKCE bypass, and token scope validation — a complete OAuth security testing checklist.
Read →Public S3 buckets, metadata SSRF, over-permissive IAM, exposed management interfaces, public snapshots, and secrets in environment variables — how to find and fix them.
Read →Breach costs, regulatory drivers, ROI calculation, and how to frame the investment to your CFO — a practical guide for security leads and engineering managers.
Read →How to find, exploit, and fix IDOR vulnerabilities — horizontal vs vertical privilege escalation, encoded IDs, GUIDs, and what automated tools miss.
Read →MTTR, shift-left ratio, vulnerability density, scan coverage — the metrics that actually matter and how to report them to leadership without making their eyes glaze over.
Read →How XXE works mechanically, classic and blind variants, SSRF through XXE, file-upload vectors (SVG, DOCX, SAML), OOB exfiltration, and language-specific remediation in Python, Java, PHP, and .NET.
Read →How to audit HTTP security headers — what each header does, what a weak or missing header enables, and what a correct configuration looks like for CSP, HSTS, X-Frame-Options, CORP, COEP, and Permissions-Policy.
Read →Detection methodology, engine fingerprinting, and RCE payloads for Jinja2, Twig, Freemarker, Velocity, and Pebble — plus sandbox escape techniques and safe rendering patterns.
Read →MIME type bypass, magic bytes spoofing, extension blocklist evasion, polyglot files, Zip Slip path traversal, web shell upload via .htaccess, ImageMagick exploits, and post-upload access control failures.
Read →How HTTP request smuggling exploits proxy/back-end disagreements about request boundaries — CL.TE, TE.CL, and TE.TE variants, timing-based detection, session hijacking, cache poisoning, and HTTP/2 downgrade attacks.
Read →A hands-on checklist of 50 web application security tests covering recon, authentication, injection, business logic, APIs, and more — with tool references for each category.
Read →Learn how secrets scanning works, where credentials get exposed, which tools to use (truffleHog, gitleaks, detect-secrets), and how to integrate detection into CI/CD.
Read →How subdomain takeover works, detection with subfinder/subjack/nuclei, real-world cases, and DNS hygiene practices to prevent dangling CNAME exploits from becoming incidents.
Read →How to test for path traversal and local file inclusion, encoding bypass techniques, escalation from LFI to RCE via log poisoning and PHP wrappers, and what remediation actually prevents it.
Read →How to detect OS command injection vulnerabilities, blind injection confirmation via time-based and OOB techniques, commix usage, and the only remediation that actually works.
Read →How to test CSRF token validation weaknesses, SameSite cookie analysis, Referer header bypass techniques, JSON API CSRF, and building a working proof-of-concept for your pentest report.
Read →How to detect unsafe deserialization in Java (ysoserial gadget chains), Python (pickle __reduce__ abuse), and PHP (POP chains). Covers magic byte detection, exploitation patterns, and remediation.
Read →How to test your APIs against all 10 OWASP API Security categories — BOLA, broken authentication, mass assignment, SSRF, security misconfiguration, shadow APIs, and more — with concrete HTTP examples.
Read →How to test for race conditions using Burp Suite's single-packet attack, threading scripts, and HTTP/2 multiplexing. Covers limit overruns, double-spend attacks, and database-level remediation.
Read →How to exploit MongoDB operator injection ($ne, $gt, $where), authentication bypass, blind extraction via $regex, and Redis CRLF injection. Includes NoSQLMap usage and remediation patterns.
Read →How __proto__ and constructor.prototype injection pollutes Object.prototype globally, enabling privilege escalation and RCE. Covers lodash CVEs, DOM XSS, testing methodology, and Object.freeze remediation.
Read →How open redirect parameters enable phishing, OAuth token theft, and SSRF amplification. Covers parameter discovery, bypass techniques (protocol confusion, encoding), OAuth-specific testing, and remediation.
Read →How unkeyed headers, fat GET requests, and CDN normalization quirks turn caches into attack delivery mechanisms. Covers Param Miner usage, cache key analysis, and CDN-specific exploitation patterns.
Read →How invisible iframes, drag-and-drop attacks, and cursor manipulation trick users into unintended actions. Covers X-Frame-Options, CSP frame-ancestors, sandbox bypass, and when SAMEORIGIN isn't enough.
Read →How to test WebSocket endpoints for cross-site WebSocket hijacking (CSWSH), authentication bypass, per-message access control flaws, and injection attacks. Covers Burp Suite, websocat, and wscat testing workflows.
Read →A practitioner's guide to threat modeling before testing — STRIDE categories with web app examples, PASTA's 7 stages, data flow diagrams, trust boundaries, and turning threats into concrete test cases.
Read →How to find S3 misconfigs, open security groups, wildcard IAM policies, and privileged Kubernetes containers before they reach production. Covers Trivy, Checkov, OPA/Conftest, and CI/CD pipeline integration.
Read →How to find authentication bypass vulnerabilities — forced browsing, parameter manipulation, JWT alg:none and RS256-to-HS256 confusion, OAuth state attacks, SAML XML signature wrapping, and SSO replay attacks.
Read →A practical guide to TLS security testing — deprecated protocols, weak cipher suites, BEAST, POODLE, DROWN, Heartbleed, HSTS misconfiguration, and certificate chain validation. Includes testssl.sh workflows.
Read →How attackers compromise software through dependencies — dependency confusion, typosquatting, compromised maintainers, and CI/CD pipeline attacks. Includes SCA tool workflows and SBOM generation.
Read →Mass assignment lets attackers set internal object properties through API requests — privilege escalation, free subscription upgrades, payment fraud. Covers Rails, Node.js, Django, Laravel, and GraphQL.
Read →How LDAP injection works in enterprise applications — authentication bypass, user enumeration, and directory traversal. Covers filter syntax, Active Directory specifics, and detection payloads.
Read →How session attacks work — fixation, cookie theft via XSS, network sniffing, and token prediction — and what to test. Covers cookie flags, token entropy, logout invalidation, and session regeneration on login.
Read →How SAML 2.0 breaks — XML Signature Wrapping (XSW1-XSW8), unsigned assertion acceptance, certificate substitution, attribute tampering, and replay attacks. Covers SAMLRaider workflow and enterprise SSO testing checklist.
Read →How OIDC breaks — redirect URI bypass, missing nonce/state checks, ID token validation shortcuts (alg:none), account linking flaws, and authorization code interception. Covers PKCE, implicit flow risks, and issuer mix-up attacks.
Read →How attackers exploit CI/CD pipelines — pipeline injection via pull requests, secrets exposure in logs, dependency confusion, malicious third-party actions, overpermissioned tokens, and self-hosted runner risks.
Read →DNS rebinding bypasses the same-origin policy to reach internal services. Covers zone transfer testing, DNSSEC validation, dangling record takeover, SPF/DKIM/DMARC configuration, and Host header validation for rebinding defense.
Read →A structured bug bounty workflow from scope analysis and asset discovery to exploitation, vulnerability chaining, and writing reports that get paid. Covers recon, IDOR, SSRF, business logic, and tools reference.
Read →SPA-specific vulnerabilities that traditional scanners miss — client-side route authorization bypass, DOM XSS via dangerouslySetInnerHTML and v-html, JWT storage risks, CORS misconfigurations, OAuth PKCE validation, and postMessage injection.
Read →How to run a vulnerability management program — triaging scanner output, risk-based prioritization beyond CVSS, SLA setting, effective developer handoff, verification testing, exception handling, and program metrics that matter.
Read →OWASP MSTG methodology for mobile apps — APK decompilation, Frida-based runtime analysis, iOS Keychain and NSUserDefaults assessment, certificate pinning bypass, insecure data storage, and backend API testing for mobile attack surfaces.
Read →Security testing for applications built on large language models — OWASP LLM Top 10, direct and indirect prompt injection, system prompt leakage, insecure output handling, excessive agency in agentic systems, and RAG/embedding attack surface.
Read →Security assessment methodology for serverless architectures — event injection via API Gateway, S3, and SQS; IAM privilege escalation via over-permissioned execution roles; secrets in environment variables; SSRF against the instance metadata service; and dependency scanning for Lambda packages.
Read →GraphQL-specific attack surface — introspection abuse for schema enumeration, field suggestion attacks when introspection is disabled, IDOR via argument-level access control, authorization bypass through nested type traversal, SQL/NoSQL injection in resolvers, and batching attacks that bypass rate limiting.
Read →Container security assessment methodology — Trivy image scanning, secrets in image layers, Dockerfile static analysis, privileged mode escape via cgroup notification, dangerous Linux capabilities, Docker socket exposure, and CIS Docker Benchmark automation with Docker Bench for Security.
Read →Cluster security testing methodology — RBAC enumeration with kubectl-who-can, pod creation as privilege escalation, service account token abuse from inside compromised pods, network policy gap testing, etcd encryption verification, and cluster-level assessment with kube-bench and kube-hunter.
Read →How to use Burp Suite Pro effectively — proxy setup and CA certificate installation, Repeater and Intruder attack types, active scanner configuration, Turbo Intruder for race conditions, Burp Collaborator for out-of-band detection, authenticated scanning with macros, and essential extensions.
Read →Spring Boot security assessment — actuator endpoint exposure (/actuator/env, /actuator/heapdump), Spring Security misconfiguration patterns, SpEL injection to RCE, Java deserialization with ysoserial, JPQL injection, SSRF via RestTemplate, and mass assignment via entity-as-RequestBody.
Read →How to discover, catalog, and continuously monitor your web application attack surface — subdomain enumeration with subfinder and amass, API surface discovery, cloud asset exposure (S3, Azure blob), orphaned endpoints, shadow IT, and integrating continuous scanning into DevSecOps.
Read →Rails security testing methodology — ActiveRecord SQL injection via string interpolation and find_by hash input, strong_parameters bypass, CSRF protection gaps in API controllers, secret_key_base exposure, Brakeman static analysis, bundler-audit dependency scanning, and Pundit/CanCanCan authorization gaps.
Read →PHP security testing methodology covering Laravel SQL injection via whereRaw and orderByRaw, PHP unserialize() exploitation with phpggc gadget chains, Twig and Blade SSTI, mass assignment bypass, PHP type juggling authentication bypasses, file inclusion with PHP wrappers, and Composer dependency scanning.
Read →ASP.NET Core security testing guide: ViewState deserialization with ysoserial.net, Data Protection key exposure, EF Core raw SQL injection, OIDC and Azure AD misconfiguration (missing audience validation, multi-tenant issuer bypass), antiforgery token bypass, Razor Pages XSS, Newtonsoft.Json TypeNameHandling RCE, and NuGet dependency scanning.
Read →How to write a penetration testing report that gets findings fixed — executive summary for non-technical stakeholders, the five-part finding structure (description, evidence, impact, remediation), CVSS scoring and contextual risk adjustment, avoiding common report mistakes, and structuring findings so developers can reproduce and fix them.
Read →Penetration testing costs range from €5,000 to €120,000+ depending on scope, methodology, and vendor type. This guide breaks down what drives price, what different tiers get you, and where automated scanning changes the economics.
Read →A complete guide to web application reconnaissance: Certificate Transparency logs, DNS enumeration, Google dorks, Shodan, GitHub OSINT, web archive analysis, and technology fingerprinting used by professional penetration testers.
Read →How to use ffuf, feroxbuster, and Burp Suite Intruder for directory discovery, parameter fuzzing, API endpoint enumeration, and input injection testing. Covers wordlist strategy, response filtering, and integration into security testing workflows.
Read →PTaaS delivers continuous automated security testing instead of point-in-time annual pentests. This guide covers what PTaaS is, how it works, what to look for in a provider, pricing models, and how it fits alongside manual penetration testing for compliance.
Read →XS-Leaks let attackers infer sensitive user data by observing browser behavior across origins — without reading response bodies. Covers error oracles, timing attacks, frame count leaks, cache probing, and the COOP/CORP/Fetch Metadata defenses that mitigate them.
Read →E-commerce applications face attacks that generic web security testing misses: price tampering, coupon abuse, race conditions in checkout, webhook replay, refund IDOR, and Magecart skimmer exposure. Plus what PCI DSS v4.0 actually requires for penetration testing scope.
Read →Information disclosure leaks sensitive data that makes every other attack easier — stack traces revealing framework versions, debug endpoints exposing environment variables, API responses returning more than the UI shows, and secrets hardcoded in JavaScript bundles.
Read →A misconfigured CSP is worse than no CSP — it creates false confidence. Covers the most common bypass conditions: unsafe-inline, JSONP on allowlisted domains, Angular template injection, wildcard CDN sources, static nonces, and how to validate a policy actually stops XSS exploitation.
Read →Credential stuffing and password spraying account for the majority of account takeovers. Learn how to test rate limiting thresholds, lockout bypass vectors, CAPTCHA effectiveness, MFA enforcement gaps, and breach password detection — without launching a live attack against real users.
Read →Active Directory is the backbone of most enterprise environments — and one of the most reliable paths to full domain compromise. Covers enumeration with BloodHound, Kerberoasting, AS-REP roasting, ACL abuse, delegation attacks, DCSync, and golden/silver ticket persistence.
Read →The OWASP LLM Top 10 defines the critical security risks specific to applications built on large language models. This guide covers all ten categories — prompt injection, insecure output handling, excessive agency, plugin design, model theft — and how to test for each.
Read →Network penetration testing covers a different attack surface than web application testing — exposed services, unpatched CVEs, lateral movement, and internal compromise paths. This guide covers external perimeter assessment, internal network testing, and wireless security evaluation.
Read →Zero Trust is an architecture, not a product — and most implementations have gaps between the marketing and the enforcement. This guide covers testing ZT deployments for authentication bypass, implicit trust in legacy systems, service account exceptions, and east-west blind spots.
Read →When your web application is breached, what you do in the first 24 hours determines the outcome. Covers evidence preservation, triage, containment options (WAF blocks to full maintenance mode), webshell detection, log analysis, root cause identification, and regulatory notification timelines.
Read →API gateways are your first line of defense — and a common source of misconfigurations. Learn how to test Kong, AWS API Gateway, Azure APIM, and Nginx for authentication gaps, rate limiting bypasses, path traversal routing vulnerabilities, and admin API exposure.
Read →How to find and exploit JSONP hijacking vulnerabilities. Covers stealing authenticated API responses across origins, callback parameter injection for XSS, JSONP-based CSRF, content-type sniffing bypass, and identifying JSONP endpoints in modern applications where CORS has replaced most uses.
Read →How to detect and exploit timing-based side channels. Covers username enumeration via response timing, time-based blind SQL injection, JWTs with predictable timing on HMAC comparison, race conditions in payment flows, and using statistical analysis to distinguish timing differences in noisy networks.
Read →Complete guide to second-order (stored) SQL injection. Covers how payloads stored safely during input are later executed in insecure query contexts, tracing data flow through registration/profile/settings flows, and techniques for finding SQLi that automated scanners miss entirely.
Read →Security testing guide for WebAssembly. Covers decompiling WASM binaries with WABT and Ghidra, extracting hardcoded secrets from data segments, bypassing client-side license checks via binary patching, testing the JS-WASM interface for memory corruption, and timing side-channel analysis of WASM cryptographic code.
Read →Server-side template injection in Node.js applications. Covers Handlebars prototype pollution to RCE, Pug inline code execution, EJS options injection (outputFunctionName bypass), Nunjucks constructor chain exploits, polyglot detection payloads, and engine fingerprinting from error messages.
Read →How to use OpenAPI specifications for security testing. Covers discovering exposed specs at common paths, extracting all endpoints and authentication gaps, schema-driven fuzzing with schemathesis, BOLA/IDOR via path parameter analysis, mass assignment from schema definitions, and importing specs into Burp Suite, ZAP, and Nuclei.
Read →Security testing guide for Go web applications. Covers SQL injection in database/sql and GORM, SSRF via net/http with cloud metadata payloads, template injection in text/template vs html/template, race conditions in concurrent handlers, path traversal in filepath.Join, mass assignment in Gin, and authentication issues in Echo and Fiber frameworks.
Read →Security testing guide for Rust web applications. Memory safety doesn't mean application security — covers SQL injection in Diesel and sqlx raw queries, SSRF in reqwest, unsafe block vulnerabilities, integer overflow in release builds, serde deserialization DoS, optional guard bypass in Rocket, missing middleware coverage in Axum, and path traversal in file operations.
Read →How to build a security champions program that actually distributes security knowledge across development teams. Covers selection criteria, time allocation, the 90-day training curriculum, SDLC integration touchpoints, metrics for measuring effectiveness, and the four failure modes that kill most programs within 18 months.
Read →Security testing guide for Next.js applications. Covers SSRF via API routes, authentication bypass in middleware edge cases, Server Actions authorization gaps, React Server Components information disclosure, environment variable leakage via NEXT_PUBLIC_ prefix, and next.config.js misconfigurations including open redirects and missing security headers.
Read →Security testing guide for FastAPI services. Covers JWT authentication bypass in fastapi-users, Depends() chain authorization gaps, Pydantic mass assignment via extra="allow", SQL injection in SQLAlchemy text() queries, SSRF in async httpx clients, CORS misconfiguration with allow_origins=["*"] and credentials, and exposed /docs and /openapi.json endpoints in production.
Read →Security testing guide for Firebase-backed applications. Covers Firestore security rules misconfigurations including open read/write access, Firebase Authentication abuse and account takeover via unlinked OAuth providers, Storage bucket access control issues, Realtime Database open rules, Cloud Functions without auth, and discovering Firebase misconfigurations via REST API testing.
Read →Security testing guide for Vue.js applications. Covers XSS via v-html directive bypassing template escaping, Vue 2 template injection via constructor.constructor(), Vue Router async guard bypass, Pinia/Vuex state exposure via window.__pinia, dynamic component injection with untrusted :is bindings, and Nuxt.js SSRF via $fetch() in server routes.
Read →Security testing guide for Angular applications. Covers DomSanitizer bypass via bypassSecurityTrustHtml and related methods, JIT vs AOT template injection risk, async CanActivate guard bypass timing issues, Angular Universal SSR SSRF via HttpClient, environment.ts API key exposure, and prototype pollution via component Input() bindings.
Read →Security testing guide for Redis deployments. Covers unauthenticated Redis discovery via nmap and redis-cli, RCE via CONFIG SET to write SSH authorized_keys or cron reverse shells, SSRF-to-Redis via gopher:// protocol payloads, deserialization attacks in Laravel and PHP Redis clients, session hijacking from exposed Redis session stores, and Lua scripting injection.
Read →Complete Azure AD / Entra ID penetration testing guide covering tenant enumeration, password spraying, token theft, privilege escalation, conditional access bypass, and PRT attacks.
Read →Complete Solidity smart contract security testing guide covering reentrancy attacks, integer overflow, flash loan exploits, access control vulnerabilities, and audit methodology with Slither and Mythril.
Read →Complete service mesh security testing guide covering Istio mTLS bypass, Linkerd policy weaknesses, Consul ACL misconfiguration, control plane attacks, and sidecar proxy vulnerabilities.
Read →Complete guide to testing vertical and horizontal privilege escalation in web applications — parameter tampering, forced browsing, JWT manipulation, IDOR, mass assignment, and HTTP method override bypass techniques.
Read →How to test SaaS applications for tenant isolation failures, cross-tenant IDOR, cache misdirection, background job leakage, and GraphQL traversal vulnerabilities that expose one customer's data to another.
Read →Practical guide to testing API key security — detecting leaked keys in source code and HTTP responses, testing over-privileged key scopes, verifying rotation policies, and auditing transmission security with TruffleHog, Gitleaks, and Burp Suite.
Read →Complete SSRF penetration testing guide covering blind SSRF detection, cloud metadata exploitation (AWS/GCP/Azure IMDS), filter bypass techniques (DNS rebinding, CRLF injection, URL encoding), and port scanning via SSRF.
Read →Complete broken authentication testing guide covering session fixation, token predictability, credential stuffing defense testing, remember-me vulnerabilities, JWT weaknesses, and authentication bypass techniques using Burp Suite.
Read →Complete Kubernetes RBAC penetration testing guide covering privilege escalation paths, ClusterRole abuse, ServiceAccount token theft, admission controller bypass, namespace escape, and RBAC misconfiguration discovery with kubectl and Kali Linux.
Read →How to test AWS S3 buckets for public access, ACL misconfigurations, bucket policy flaws, and data exposure vulnerabilities. Practical methodology using AWS CLI, S3Scanner, and manual techniques for penetration testers and cloud security auditors.
Read →How to find and exploit exposed Spring Boot Actuator endpoints — env, heapdump, mappings, beans, and shutdown. A practical guide to testing actuator security in production applications, including credential extraction and remote code execution paths.
Read →Complete guide to Jenkins security testing: exposed dashboards, Script Console remote code execution, credential store extraction, pipeline poisoning, CVE-2024-23897 exploitation, and hardening checklist for CI/CD pipeline security.
Read →Complete guide to Elasticsearch and OpenSearch security testing: unauthenticated index access, data exfiltration via scroll API, Kibana exploitation, Schema Registry attacks, Amazon OpenSearch Service misconfiguration, and security hardening.
Read →Complete Kafka security testing guide: unauthenticated broker access, topic enumeration, real-time message interception, consumer group hijacking, Schema Registry exploitation, Kafka Connect SSRF, and SASL/ACL hardening.
Read →Complete guide to GitLab CI/CD security testing: pipeline injection via .gitlab-ci.yml manipulation, CI variable exfiltration, masked variable bypasses, runner token theft, privileged container escape, container registry image poisoning, and API token abuse.
Read →Practical guide to Helm chart security auditing: extracting plaintext secrets from release history, finding misconfigured templates (privileged containers, hostPath mounts), supply chain verification gaps, RBAC escalation via hooks, and remediation with Sealed Secrets and Cosign.
Read →Comprehensive AWS IAM security testing guide: automated permission enumeration, 14+ documented escalation paths (CreatePolicyVersion, PassRole+Lambda/EC2/CloudFormation, UpdateAssumeRolePolicy), IMDS credential theft via SSRF, cross-account trust exploitation, and remediation with SCPs and Permission Boundaries.
Read →Practical guide to testing Spring Security misconfigurations: filter chain bypasses via path traversal and CVE-2022-22978, CSRF disabled detection, remember-me token forgery, session fixation, @PreAuthorize proxy bypass via AOP limitations, and OAuth2 open redirect testing with a secure configuration template.
Read →Complete ArgoCD security testing guide: unauthenticated API enumeration, default credential exploitation, RBAC wildcard abuse and pod exec escalation, repository credential theft from Kubernetes Secrets, manifest secret dumping, malicious sync injection, ApplicationSet controller abuse, and cluster takeover techniques.
Read →Comprehensive Lambda security testing guide: environment variable secret extraction, SSRF to IMDS credential theft, SQL/NoSQL injection via event data, IAM execution role abuse with 14+ escalation paths, Lambda layer poisoning, execution environment persistence, and hardening with least-privilege roles and Secrets Manager.
Read →Comprehensive GCP IAM security testing guide: service account key theft via gcloud CLI, IMDS credential harvesting at metadata.google.internal, workload identity federation misconfiguration, actAs and setIamPolicy privilege escalation paths, lateral movement across projects, and hardening with VPC-SC and Workload Identity.
Read →Deep dive into Azure DevOps security testing: SYSTEM_ACCESSTOKEN abuse, pipeline YAML injection via unsanitized variables, AzureCLI@2 service connection credential exfiltration, PAT token discovery with regex patterns, self-hosted agent exploitation for internal network recon, and Artifacts feed poisoning attacks.
Read →Complete Vault security testing guide: token discovery across environment variables and Kubernetes secrets, wildcard policy exploitation, AppRole role_id and secret_id theft, Kubernetes auth method wildcard abuse, bulk secret exfiltration with recursive vault list, and hardening with sentinel policies and response wrapping.
Read →Comprehensive Terraform security testing guide: scanning HCL with tfsec and Checkov, extracting secrets from state files via jq, stealing AWS/GCP/Azure provider credentials, attacking S3 and Terraform Cloud backends, exploiting unpinned modules in the supply chain, and hardening with KMS encryption and OIDC-based CI credentials.
Read →Security audit guide for GitHub Advanced Security: testing CodeQL query suite coverage gaps, bypassing secret scanning with encoded and split secrets, exploiting Dependabot auto-merge misconfigurations, auditing pull_request_target workflows for privilege escalation, reviewing Actions permissions, and detecting SARIF result suppression.
Read →Complete container registry security testing guide: extracting secrets from image layers with dive and trivy, exploiting Docker Hub and ECR/GCR/ACR misconfigurations, namespace squatting and supply chain substitution attacks, image signing bypass with cosign policy gaps, and hardening with immutable tags and BuildKit mount secrets.
Read →Complete monitoring stack security testing guide: discovering unauthenticated Prometheus endpoints, extracting infrastructure intelligence from metrics, PromQL injection and admin API abuse, Grafana default credentials and CVE-2021-43798 path traversal, SSRF via datasource configuration, Alertmanager alert silencing and config extraction, and Pushgateway metric injection attacks.
Read →Comprehensive RabbitMQ security testing guide: exploiting default guest credentials on the management API, enumerating queues and reading message payloads, AMQP credential brute force, Erlang cookie theft for cluster RCE, message injection for business logic attacks, virtual host isolation bypass, shovel plugin SSRF and exfiltration, and federation upstream credential extraction.
Read →Complete CloudFormation security testing guide: scanning templates with cfn-nag and Checkov, extracting plaintext secrets from stack parameters and event history, cross-stack export enumeration, custom resource Lambda role privilege escalation, StackSets cross-account exploitation, service role abuse for admin access, and drift-based attack detection.
Read →Comprehensive Nginx Ingress Controller security testing: annotation injection for multi-tenant cluster escape, CVE-2021-25742 snippet annotation Lua code execution, auth-url authentication bypass via header manipulation, path traversal through rewrite rules, ModSecurity WAF bypass techniques, and SSRF via ExternalName service pivoting into internal Kubernetes networks.
Read →Complete AWS EKS security testing guide: aws-auth ConfigMap privilege escalation to system:masters, node IAM role IMDS credential theft with IMDSv1/v2, OIDC identity provider wildcard trust exploitation for role assumption, EKS Pod Identity attacks, public cluster endpoint exposure, and lateral movement from compromised pods to AWS services (ECR, Secrets Manager, S3).
Read →Security testing guide for OpenTelemetry and distributed tracing pipelines: auditing spans for leaked credentials and PII in http headers/db queries/error messages, exploiting unauthenticated OTLP collectors, extracting API keys from collector configs via zpages, Jaeger/Zipkin/Tempo unauthenticated trace access, trace injection attacks, and baggage header abuse for authorization bypass.
Read →Comprehensive Splunk SIEM security testing: default admin credentials, REST API credential and token extraction, SPL injection attacks for data exfiltration, HEC token theft and log injection to blind security teams, dashboard XSS via injected events, Universal Forwarder exploitation, and alert action command injection techniques.
Read →AWS WAF security testing guide: bypassing AWSManagedRulesSQLiRuleSet and CommonRuleSet via double URL encoding and comment injection, XSS bypass using SVG handlers and HTML entity encoding, managed rule group gap analysis (Log4Shell obfuscation, Bot Control bypass), rate-based rule evasion via X-Forwarded-For spoofing, and CloudFront origin bypass to reach ALB directly.
Read →Memcached penetration testing guide: exploiting default no-authentication TCP access to enumerate and dump all cached keys, extracting session tokens and API keys, cache poisoning via CRLF injection in key names, assessing UDP port 11211 for DRDoS amplification (51,000x amplification factor used in the 1.7 Tbps GitHub attack), SASL authentication testing, and Memcached hardening.
Read →Falco runtime security assessment guide: systematically mapping default rules against MITRE ATT&CK to find coverage gaps, testing fileless execution via memfd_create, container escape detection (docker socket, nsenter, cgroup notify_on_release), alert pipeline end-to-end validation and MTTD measurement, eBPF probe security, syscall-level evasion techniques, and writing effective custom detection rules.
Read →Azure Blob Storage penetration testing: enumerating public containers via common name brute force, SAS token privilege analysis and parameter exploitation (write/delete tokens), storage account key extraction from IMDS/Key Vault/code, managed identity abuse via SSRF to IMDS, ADLS Gen2 POSIX ACL bypass, CORS wildcard misconfiguration, and comprehensive Azure Storage hardening.
Read →Keycloak IAM security testing: admin console internet exposure and default credential testing, realm misconfiguration audit (brute force protection, SSL requirements, token lifespan), client secret theft for service account impersonation, wildcard redirect_uri exploitation for authorization code theft, RS256-to-HS256 algorithm confusion token forgery, user enumeration via error messages, and hardening guide.
Read →AWS GuardDuty security assessment: auditing which protection plans are enabled (S3, EKS, Lambda, RDS), testing detection gaps via slow IAM enumeration below threshold, suppression rule audit for overly broad criteria, trusted IP list bypass paths, CloudTrail tampering detection validation, generating sample findings to test alert pipelines end-to-end, and measuring MTTD from finding creation to team notification.
Read →GCP Cloud Storage penetration testing: discovering public buckets via JSON API, auditing allUsers/allAuthenticatedUsers IAM bindings, signed URL expiry and permission analysis, HMAC key discovery and S3-compatible API abuse, service account key extraction from GCE metadata, fine-grained ACL vs uniform bucket-level access testing, and org policy enforcement for public access prevention.
Read →Envoy proxy security testing: exploiting admin interface config_dump for TLS certificate and endpoint extraction, testing xDS control plane debug endpoint access, JWT authentication filter bypass via uncovered routes and header injection, external authorization failure_mode_allow misconfiguration, Istio PERMISSIVE mTLS mode testing, RBAC AuthorizationPolicy wildcard gaps, and direct pod IP bypass to skip sidecar enforcement.
Read →Systematic Cilium CNI security testing: network policy bypass via hostNetwork pods and NodePort, identity spoofing through pod label manipulation, Hubble observability blind spots and unauthenticated relay access, eBPF map inspection via CAP_BPF, and Tetragon runtime security coverage testing for Kubernetes environments.
Read →Test AWS Inspector v2 coverage completeness: ECR rescan duration gaps, EC2 instances without SSM agent coverage, Lambda layer blind spots, suppression rule misuse for CRITICAL findings, IAM privilege escalation to enumerate vulnerabilities, and cross-validation with Trivy/Grype to catch Inspector database lag.
Read →Comprehensive OPA security testing: Rego undefined-field bypass via absent securityContext fields, admission webhook failurePolicy:Ignore exploitation, namespace exemption label abuse, Gatekeeper dryrun constraints that never block workloads, OPA bundle signing bypass, and data API enumeration exposing authorization policy state.
Read →Systematic Apache Cassandra security testing: unauthenticated JMX access on port 7199 enabling remote code execution via MBean operations, default cassandra/cassandra credentials, CQL injection and CVE-2021-44521 UDF RCE, plaintext inter-node gossip, nodetool remote exploitation, and data exfiltration via unauthenticated COPY command.
Read →Traefik security testing: unauthenticated dashboard on port 8080 revealing all routing configuration and backend addresses, REST API routing manipulation, Docker label injection via compromised containers, IngressRoute misconfiguration with no auth middleware, ACME private key exposure, and IPWhiteList bypass via X-Forwarded-For spoofing.
Read →SonarQube security testing: default admin/admin credential exploitation, unauthenticated project browsing and source code read, CI token privilege escalation, webhook SSRF to cloud metadata, SCM credential theft via admin API, quality gate bypass by dismissing security hotspots, and CVE-2021-43959 OGNL injection for settings extraction.
Read →Systematic Datadog security testing: API key and app key extraction from config files and Kubernetes secrets, DogStatsD UDP metric injection to manipulate dashboards and suppress alerts, Datadog agent configuration credential exposure, AWS integration IAM over-privilege, detection coverage gap analysis, and monitor mute_all via stolen app key.
Read →MinIO object storage security testing: default minioadmin credential exploitation, anonymous bucket enumeration and data exfiltration, IAM policy wildcard resource bypass, admin console port 9001 unauthenticated access, presigned URL expiry and scope testing, webhook notification SSRF, and server-side encryption enforcement gaps.
Read →Argo Workflows security testing: server auth-mode unauthenticated API access, workflow template parameter injection enabling shell command injection, service account RBAC privilege escalation for cross-namespace secret access, artifact repository S3 credential extraction from workflow pods, and namespace isolation bypass for multi-tenant clusters.
Read →Kyverno security testing: webhook failurePolicy:Ignore exploitation, all-audit-mode policy bypass for initial access, label selector bypass by deploying unlabeled pods, PolicyException self-approval for policy circumvention, generate rule privilege escalation via namespace creation, mutate rule override testing, and PolicyReport background scan drift analysis.
Read →Teleport PAM security testing: SSH short-lived certificate privilege escalation, Kubernetes kubeconfig token extraction, session recording mode bypass via direct node access, Teleport RBAC role audit for root login and system:masters K8s groups, database access credential testing, and audit log completeness and tamper detection analysis.
Read →Crossplane security testing: provider credential secret exposure, ProviderConfig manipulation to redirect managed resources, managed resource RBAC over-grant enabling unauthorized cloud provisioning, composition injection via user-controlled claim fields, XR claim privilege escalation by setting providerConfigRef, and connection secret cross-namespace exposure.
Read →Flux CD security testing: source controller git credential secret exposure (SSH private keys and deploy tokens), Kustomization cross-namespace source reference exploitation, HelmRelease value injection via developer-controlled ConfigMaps, RBAC privilege escalation via kustomize-controller service account cluster-admin permissions, and GitRepository webhook HMAC token spoofing.
Read →External Secrets Operator security testing: SecretStore provider credential exposure, ClusterSecretStore namespace isolation bypass allowing cross-team secret access, ExternalSecret field path extraction abuse via dataFrom wildcard keys, backend IAM over-privilege testing for AWS/GCP/Azure, and PushSecret data exfiltration path analysis for misconfigured stores.
Read →cert-manager security testing: ACME account private key exposure enabling certificate forgery, DNS01 solver IAM credential over-privilege for Route53/Cloudflare, CA Issuer private key extraction for internal PKI compromise, CertificateRequest self-approval privilege escalation, ClusterIssuer namespace isolation bypass, and certificate rotation gap analysis.
Read →Velero security testing: backup storage location S3 credential exposure enabling all backed-up secrets to be read, restore privilege escalation by restoring privileged workloads and elevated RBAC bindings, S3 bucket public access and encryption gap analysis, volume snapshot credential theft, and malicious BackupStorageLocation injection for unauthorized cluster restoration.
Read →Rancher multi-cluster management security testing: default admin credential exploitation, API token non-expiry enumeration, cluster registration token theft enabling fake cluster import, Rancher project namespace RBAC isolation bypass, catalog application deployment privilege escalation, and downstream cluster direct API access bypassing Rancher proxy controls.
Read →Tekton security testing: TaskRun service account privilege escalation, parameter injection via unquoted substitution in shell scripts, workspace PVC cross-run data leakage, Tekton Dashboard unauthenticated TaskRun creation, secret exposure in pipeline logs and results, and supply chain security gaps from missing Tekton Chains attestation.
Read →AWS Cognito security testing: JWT token manipulation via algorithm confusion attacks, user pool enumeration through error message differentiation, Cognito group privilege escalation via self-service attribute modification, hosted UI OAuth misconfiguration, identity pool unauthenticated role abuse, and admin-level API operations from user tokens.
Read →HashiCorp Consul security testing: unauthenticated API access via ACL default-allow misconfiguration, gossip encryption key extraction enabling cluster join and traffic eavesdropping, health check script injection achieving RCE on agent hosts, KV store credential exposure, Consul Connect intention bypass, and DNS interface information disclosure.
Read →NATS messaging security testing: unauthenticated publish/subscribe exploitation, subject authorization bypass via wildcard pattern abuse, JetStream stream historical message replay access, account isolation bypass in multi-tenant clusters, credentials file exposure, service endpoint impersonation via subject spoofing, and monitoring endpoint information disclosure.
Read →etcd security testing: unauthenticated HTTP API access extracting all Kubernetes Secrets and ConfigMaps in plaintext, peer authentication bypass enabling rogue cluster member injection, snapshot exfiltration for full cluster state access, mTLS certificate validation testing, and encryption-at-rest gap verification for Kubernetes Secret protection.
Read →Apache ZooKeeper security testing: unauthenticated ZNode read/write access, ACL world:anyone scheme bypass, four-letter word commands (stat/dump/envi) exposing internal state and Kafka broker topology, Kafka credential extraction from ZNodes, AdminServer HTTP API information disclosure, and ensemble communication interception.
Read →Spinnaker security testing: Gate API unauthenticated pipeline triggering enabling unauthorized production deployments, Clouddriver cloud provider IAM credential exposure, Fiat authorization bypass for cross-application pipeline access, Halyard configuration credential exfiltration, and pipeline artifact injection for supply chain compromise.
Read →Linkerd service mesh security testing: mTLS enforcement gaps via uninjected pods, Server resource coverage analysis for authorization policy bypass, identity issuer certificate theft from proxy sidecars, control plane API security, multicluster link credential exposure, and Linkerd viz dashboard unauthenticated access testing.
Read →Apache Pulsar security testing: unauthenticated broker and admin REST API access, tenant namespace isolation bypass for cross-tenant message theft, Pulsar Functions worker arbitrary Python/Java code execution, JWT token 'none' algorithm bypass, admin API privilege escalation, and BookKeeper metadata exposure.
Read →Istio security testing: PeerAuthentication PERMISSIVE mode allowing plaintext from uninjected pods, AuthorizationPolicy coverage gaps with default-allow behavior, Envoy admin interface port 15000 exploitation for certificate extraction, istiod control plane debug endpoint abuse, JWT RequestAuthentication bypass, and egress gateway escape for data exfiltration.
Read →Knative security testing: container privilege escalation via permissive pod security, CloudEvents broker Trigger sink SSRF, RBAC over-privilege enabling arbitrary workload deployment, traffic split shadow request capture, Kourier/Istio ingress gateway bypass, and autoscaling cold start timing attacks across Knative Serving and Eventing.
Read →ClickHouse security testing: default empty password on admin user enabling full unauthenticated access, file() table function reading arbitrary local files including /etc/passwd and application secrets, url() function SSRF to cloud metadata services, SQL injection via concatenated HTTP query parameters, user privilege escalation through role misassignment, and HTTP interface port 8123 information disclosure.
Read →HashiCorp Nomad security testing: ACL anonymous policy bypass for unauthenticated job submission, raw_exec driver running commands directly on host without isolation, exec driver namespace escape via volume mounts, Vault integration credential over-privilege where workloads receive broad Vault tokens, gossip encryption key exposure enabling rogue cluster member join, and HTTP API port 4646 unauthenticated access.
Read →SPIFFE/SPIRE security testing: agent Unix socket world-readable permissions allowing any local process to obtain workload SVIDs, registration entry over-broad selectors enabling SVID theft from unprivileged workloads, trust bundle theft for offline SVID forgery, trust domain federation bypass for cross-domain lateral movement, SPIRE server admin API without mTLS authentication, and attestation plugin join-token reuse.
Read →OpenFaaS security testing: gateway unauthenticated function invocation and enumeration without basic auth, async invocation X-Callback-Url SSRF to cloud metadata services and internal APIs, function secret names exposed via /system/secrets, faas-netes service account cluster-admin over-privilege, Docker socket mounting enabling host escape from function containers, and envVars credentials visible in system API response.
Read →CockroachDB security testing: insecure mode granting unauthenticated root access without TLS or password, rogue cluster node join via compromised CA certificate, HTTP admin UI port 8080 exposing cluster metadata without authentication, SQL injection via concatenated queries, ADMIN role privilege escalation through GRANT abuse, and IMPORT/EXPORT statement SSRF to cloud metadata services and internal Kubernetes APIs.
Read →Vitess security testing: VTGate SQL injection via MySQL protocol on port 3306 bypassing sharding layer, VTTablet gRPC and HTTP management port unauthenticated access exposing tablet operations and MySQL credentials, VTAdmin web UI without authentication allowing full cluster management, vtctld topology data exfiltration, and keyspace isolation bypass for cross-database data access.
Read →KEDA security testing: operator ClusterRole allowing cluster-wide Kubernetes Secret reads for TriggerAuthentication, ScaledObject manipulation causing production scale-to-zero DoS or resource exhaustion, TriggerAuthentication Secret name enumeration, external scaler SSRF via attacker-controlled endpoint URLs, ClusterTriggerAuthentication cross-namespace tenant isolation bypass, and unbounded maxReplicaCount resource exhaustion attacks.
Read →Longhorn distributed storage security testing: manager REST API unauthenticated access enabling volume operations, backup target S3/NFS credential exposure in Longhorn settings and Kubernetes Secrets, volume encryption key Secret theft via over-permissive RBAC, Longhorn manager ClusterRole excessive Secret read permissions, instance-manager process gRPC port exposure, and cross-namespace volume attachment bypass.
Read →Harbor container registry security testing: default admin password Harbor12345 enabling full registry control, robot account token theft for persistent pull/push access, project isolation bypass for cross-project image access without authorization, webhook SSRF via attacker-controlled callback URLs, registry replication credential exposure in API responses, and content trust enforcement bypass via tag mutation.
Read →Thanos security testing: Query HTTP API unauthenticated access on port 10902 exposing all tenants' metrics, multi-tenant isolation bypass via forged THANOS-TENANT header, Store gRPC API access to historical metrics from object storage, Thanos Ruler arbitrary alert rule injection for alert suppression, object storage S3/GCS credential exposure in configuration, and Query Frontend cache poisoning for cross-tenant metric leakage.
Read →Grafana Loki security testing: unauthenticated query API on port 3100 exposing all tenants' application logs including credentials and PII, multi-tenant isolation bypass via X-Scope-OrgID header forging, push API label injection for cross-tenant log stream pollution, sensitive data discovery in log content via LogQL, object storage credential exposure, and cardinality exhaustion attacks via high-cardinality label push requests.
Read →Gitea security testing: webhook callbacks make HTTP requests from the Gitea server enabling SSRF to internal services and cloud metadata endpoints, repository migration feature clones from internal Git servers for unauthorized data access, OAuth application client secret theft enabling persistent token issuance, unauthenticated repository enumeration via public API, and admin API full instance takeover with leaked admin token.
Read →Sonatype Nexus Repository Manager security testing: default admin/admin123 credentials enabling full instance control, Nexus 3 Scripting API Groovy RCE via arbitrary script execution, artifact upload to hosted repositories for supply chain poisoning, anonymous access allowing unauthorized artifact downloads, admin password file exposure in Kubernetes pod exec, and privilege escalation via role assignment through the REST API.
Read →HashiCorp Boundary PAM security testing: over-broad host set definitions allowing users to access unintended targets, brokered credentials from Vault with higher privilege than required, Boundary session tokens being long-lived and transferable enabling lateral movement if stolen, worker node compromise allowing MitM of all proxied sessions, and scope privilege escalation via misconfigured IAM bindings.
Read →Atlantis Terraform automation security testing: RCE via malicious Terraform external data source in pull requests executing on the Atlantis server, cloud credential theft from environment variables (AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS) readable via plan output, atlantis.yaml workflow shell command injection if repo config is allowed, webhook secret bypass enabling forged GitHub/GitLab events triggering plans on attacker-controlled repositories, and plan output information disclosure revealing infrastructure state to unauthorized PR viewers.
Read →Argo Events security testing: unauthenticated NATS JetStream event bus allowing any cluster workload to inject events and trigger Sensors, EventSource webhook SSRF via attacker-controlled HTTP callbacks probing internal services, Sensor trigger privilege escalation by creating ClusterRoleBindings via Kubernetes resource triggers, EventSource HTTP polling SSRF to cloud metadata services, and Argo Events controller ClusterRole granting cluster-wide Secret read access.
Read →Grafana Mimir distributed Prometheus security testing: multi-tenant isolation bypass via forged X-Scope-OrgID header enabling cross-tenant metric access, Ruler API alert rule injection silencing production alerts or triggering false positives, internal gRPC APIs between ingester/compactor/querier accessible without authentication, object storage credential exposure in Mimir configuration endpoints, and cardinality exhaustion attacks overwhelming the ingester with high-cardinality metric streams.
Read →Grafana Tempo security testing: HTTP API on port 3200 exposing all distributed traces including service-to-service call graphs and internal hostnames without authentication, multi-tenant isolation bypass via forged X-Scope-OrgID header enabling cross-tenant trace access, TraceQL sensitive data mining across span attributes for auth tokens and user IDs, object storage credential exposure in Tempo configuration endpoints, and unauthenticated OTLP trace injection allowing span forgery.
Read →Jaeger distributed tracing security testing: UI on port 16686 exposes all service traces and complete dependency graph without authentication, collector port 14268 accepts forged span injection enabling trace tampering, gRPC query API on port 16685 accessible without mTLS, span tags contain sensitive data including database queries and HTTP headers, and Elasticsearch/Cassandra backend credentials exposed in Jaeger deployment configuration.
Read →Chaos Mesh security testing: chaos-daemon DaemonSet running privileged containers with host PID namespace enabling node compromise, cross-namespace experiment targeting production pods via insufficiently scoped RBAC, StressChaos denial of service against production workloads, Chaos Dashboard accessible without authentication, controller ClusterRole granting excessive cross-namespace pod permissions, and IOChaos file corruption outside intended container paths.
Read →Concourse CI security testing: credential manager secrets accessible to all pipeline tasks by default enabling lateral movement, privileged task containers escape to worker host filesystem, fly set-pipeline with user-controlled YAML enabling arbitrary code execution, ATC API accessible without authentication on internal deployments, and Vault/CredHub integration misconfiguration exposing shared credential paths to unauthorized pipelines.
Read →Backstage developer portal security testing: scaffolder Nunjucks template injection enabling backend RCE via user-controlled parameters, backend API routes accessible without authentication exposing full service catalog, catalog entity injection via attacker-controlled YAML URLs registered as catalog locations, proxy plugin forwarding to internal services without re-authentication, and guest authentication mode exposing all service catalog data including infrastructure links.
Read →Apache Flink security testing: Web Dashboard on port 8081 allows unauthenticated JAR upload enabling arbitrary Java RCE on the JobManager, REST API accepts job graph submission without authentication, TaskManager log directory traversal exposing application credentials, job detail view reveals Kafka/JDBC/S3 connector connection strings, and checkpoint state in object storage exposes serialized connector secrets.
Read →Apache Airflow security testing: DAG files execute arbitrary Python on the scheduler and all workers making DAG repository write access a direct RCE vector, default admin/admin credentials on fresh deployments, webserver Connections page reveals database and API credentials in edit forms, Fernet key misconfiguration leaves connection passwords unencrypted in the metadata database, and REST API accessible without network controls exposing all pipeline definitions and connections.
Read →Drone CI security testing: fork pull request builds expose parent repository secrets to attacker-controlled pipeline steps, Docker runner with Docker socket access enables container escape to host, weak DRONE_RPC_SECRET allows rogue runner registration intercepting build workloads, DRONE_TOKEN in build environment enables lateral movement across all org repositories, and host path volume mounts in trusted pipelines expose cluster credentials.
Read →Pulumi security testing: state files in S3 backends contain full resource outputs including database connection strings, API keys, and TLS certificates readable by any user with S3 access; stack outputs reveal all secrets to any team member; Pulumi.*.yaml config files committed with encrypted secrets brute-forceable without passphrase; and Automation API enables infrastructure modification from compromised application code.
Read →Jupyter Notebook security testing: server running without authentication enables arbitrary Python execution via kernel API and WebSocket, built-in terminal provides full host OS shell access, cloud IMDS credential theft from within notebook cells, notebook files in version control repositories contain embedded API keys and credentials in output cells, and JupyterHub user isolation bypass via filesystem permission misconfiguration exposing other users' notebooks.
Read →Apache NiFi security testing: web UI and REST API on port 8080 accessible without authentication enabling full data flow manipulation, ExecuteScript processor accepts arbitrary Groovy code enabling OS command execution on the NiFi host, Controller Services store database and API credentials readable via the REST API, CVE-2023-34468 H2 JDBC URL RCE on unpatched versions, and Provenance repository stores sensitive data payload content accessible without authorization.
Read →MLflow security testing: tracking server on port 5000 without authentication allows model registry manipulation and production promotion, pickle-based model serialization executes arbitrary code when loaded via mlflow.pyfunc.load_model enabling supply chain RCE, artifact store credentials embedded in run metadata, unauthenticated model version stage transitions to production, and custom conda environment specifications installing attacker-controlled packages on inference servers.
Read →HashiCorp Nomad security testing: HTTP API on port 4646 accessible without authentication enabling job submission and cluster manipulation, raw_exec driver executing OS commands directly on Nomad client nodes bypassing container isolation, workload identity JWTs granting Vault access abused for cross-job secret access, ACL bootstrap token exposure in configuration files, and unencrypted Serf gossip exposing cluster topology.
Read →Apache Spark security testing: Web UI on port 4040 exposes all spark properties including cloud access keys and JDBC passwords without authentication, History Server stores all completed job logs with SQL query plans and data samples, standalone REST API on port 6066 accepts unauthenticated job submissions for code execution on workers, and JDBC connection strings visible in the application environment page.
Read →Zabbix security testing: CVE-2022-23131 SAML authentication bypass grants admin access to Zabbix 5.4.x without credentials, default Admin/zabbix credentials on unpatched deployments, agent UserParameter configuration allows Zabbix server to execute arbitrary commands on all monitored hosts, Zabbix API SQL injection on historical versions, and agent port 10050 responding to unauthorized source IP connections.
Read →Ansible Tower/AWX security testing: credential store SSH private keys and vault passwords accessible via REST API to users with over-scoped RBAC roles, job template survey variables passed unsanitized to playbooks enable command injection, AWX deployments using default or weak admin passwords, custom credential type injectors leak values via playbook output logs, and Tower machine credentials granting SSH access to all managed hosts abused via over-broad role assignment.
Read →Temporal security testing: gRPC frontend on port 7233 requires no authentication by default allowing workflow enumeration and termination, namespace isolation relies on client-provided namespace parameter without server enforcement, workflow history stores all activity inputs and outputs including sensitive business data accessible to all namespace members, rogue workers hijack task queues before legitimate workers, and mTLS disabled in development environments promoted to production.
Read →Nagios security testing: CVE-2021-25296/25298 allow authenticated OS command injection in Nagios XI via controller parameters, default nagiosadmin credentials unchanged in production deployments, NRPE with dont_blame_nrpe=1 allows Nagios server to execute arbitrary commands on all monitored hosts, configuration files expose SNMP community strings and database passwords readable by the web server process, and NRPE service accessible from unauthorized hosts without allowed_hosts restriction.
Read →SaltStack security testing: CVE-2020-11651 allows unauthenticated access to the Salt master ClearFuncs class enabling root command execution on all connected minions without credentials, CVE-2020-11652 directory traversal reads arbitrary files from the master, salt-api runner.cmd_run enables shell execution via weak eAuth configuration, ZeroMQ ports 4505-4506 exposed without TLS, and eAuth ACL configurations allowing unrestricted function access.
Read →Kubeflow security testing: Pipelines API server accessible without authentication on default single-user installations allowing arbitrary ML job execution, MinIO default credentials (minio/minio123) exposing all ML models and training data artifacts, notebook servers running as root with broad Kubernetes RBAC enabling cluster privilege escalation, OIDC proxy kubeflow-userid header injection authentication bypass, and Istio authorization policies misconfigured to allow cross-namespace lateral movement.
Read →VictoriaMetrics security testing: HTTP API on port 8428 accepts metric writes and queries without authentication enabling false metrics injection and dashboard manipulation, /api/v1/admin/tsdb/delete_series permanently deletes monitoring data without credentials, all stored observability data queryable via unauthenticated remote read API, cluster mode vminsert/vmselect/vmstorage all unauthenticated by default, and metric labels exposing infrastructure topology including internal hostnames and IP addresses.
Read →Portainer security testing: initial admin setup 5-minute window allows weak password setting or bypass; Operator-role users deploy privileged containers with host filesystem mounts enabling container escape to Docker host root; API tokens generated without expiry persist after password changes; environment variables with secrets visible to all endpoint users; Portainer agent TCP port 9001 weak TLS validation vulnerable to MITM; Portainer database stores registry credentials and SSH keys in plaintext.
Read →Apache Superset security testing: CVE-2023-27524 known default SECRET_KEY (thisISaSECRET_1234) enables Flask session cookie forgery granting admin access without valid credentials, default admin/general credentials on fresh installations, SQL Lab Jinja2 template injection exposing Flask application config via {{config}}, database connection SSRF via test endpoint probing internal services, and database passwords recoverable when SECRET_KEY is known from the default configuration.
Read →Prefect security testing: Prefect Server API on port 4200 requires no authentication on default self-hosted deployments allowing deployment enumeration and arbitrary flow run triggering, flow run parameters containing API keys and secrets stored in plaintext and accessible via API, worker processes inherit cloud credentials from environment variables exposed via flow output logging, work pool Docker image overrides execute untrusted containers, and PREFECT_API_KEY values leaked in repository secrets.
Read →Weaviate security testing: REST and GraphQL APIs on port 8080 require no authentication by default allowing enumeration of all classes, bulk export of stored vectors and document embeddings via nearText and Get queries, deletion of entire collections, and schema discovery revealing what sensitive data the application indexes; multi-tenancy misconfiguration allows cross-tenant vector access; backup endpoints create full database snapshots without authorization; and vectorizer module API keys accessible via metadata endpoint.
Read →Qdrant security testing: REST API on port 6333 and gRPC on port 6334 require no authentication on default deployments — any client lists all collections, scrolls all stored vectors with payload metadata containing source document text and URLs, creates and downloads full collection snapshots, and deletes collections without credentials; web UI at /dashboard exposes data browsing; API keys when enabled transmitted unencrypted and logged by reverse proxies.
Read →ChromaDB security testing: FastAPI server on port 8000 has no authentication by default — any client lists all collections, retrieves all stored document chunks with embeddings and metadata from LLM/RAG applications, deletes collections, and accesses all tenants; Swagger UI at /docs exposes the complete API surface; multi-tenant isolation relies on client-supplied tenant headers with no server-side authorization; static authentication tokens committed to application configuration files.
Read →Milvus security testing: gRPC API on port 19530 and REST API on port 9091 require no authentication by default — any client enumerates all collections, queries stored vectors and scalar payloads, drops production ML data, and triggers MinIO segment storage access; Milvus 2.x authentication uses root/Milvus default credentials; Attu web UI on port 8000 exposes full management without authentication; MinIO backing store deployed with minioadmin/minioadmin default credentials; etcd cluster mode port 2379 accessible without auth.
Read →Ollama security testing: REST API on port 11434 has no authentication by default — Docker deployments frequently bind to 0.0.0.0 making it reachable from any interface; any client lists all models, generates responses bypassing application-level prompt filters, deletes models, and pulls new large models consuming GPU resources; /api/show endpoint exposes full model configuration including system prompts; OLLAMA_ORIGINS misconfiguration enables CSRF attacks from attacker-controlled sites against local Ollama instances.
Read →Open WebUI security testing: first user to register on a fresh deployment automatically receives admin privileges — race condition allows attackers to claim admin in publicly accessible deployments; model access controls enforced in the UI are bypassed by accessing the underlying Ollama API directly if port 11434 is not separately firewalled; API keys have no expiry by default; admin accounts can read all users' complete conversation histories; open registration allows any internet user to access the LLM interface.
Read →Neo4j security testing: default neo4j/neo4j credentials must be changed on first login — many deployments retain weak passwords; Bolt protocol port 7687 and HTTP API port 7474 exposed without network restrictions; pre-4.0 Community Edition had authentication disabled by default; Cypher injection via string-concatenated queries allows UNION clauses to extract all graph nodes and relationships; APOC procedures including apoc.load.json enable SSRF by triggering outbound HTTP requests from the Neo4j server to internal network targets.
Read →Kafka Connect security testing: REST API on port 8083 requires no authentication by default — any network client reads all connector configurations containing plaintext database passwords, AWS access keys, and API tokens; connector creation API enables SSRF by causing Kafka Connect workers to make outbound connections to attacker-controlled internal targets; connector deletion disrupts production data pipelines; worker process credentials accessible via config endpoint on JDBC, S3 sink, and Elasticsearch connector configurations.
Read →Hasura GraphQL Engine security testing: without HASURA_GRAPHQL_ADMIN_SECRET configured, the entire auto-generated database API is open to unauthenticated clients — every table, row, and relationship is queryable without credentials; admin secret bypasses all row-level security and permission rules; GraphQL introspection is enabled by default revealing complete schema; x-hasura-role header injection tests role escalation if application forwards user-controlled headers; event trigger webhooks enable SSRF when Hasura makes outbound requests to configured endpoints.
Read →Supabase security testing: anon key is intentionally public but tables without Row-Level Security enabled are fully readable and writable by any unauthenticated user; service_role key bypasses all RLS and JWT verification — critical if leaked in client bundles or GitHub; RLS policy logic flaws allow cross-user data access; storage bucket misconfiguration exposes all user-uploaded files; Supabase Auth user enumeration via signup and password reset endpoint response differences.
Read →Apache Druid security testing: web console port 8888 and REST/SQL API port 8082 have no authentication by default — any client executes SQL against all datasources; ingestion API enables SSRF by triggering outbound HTTP requests from Druid nodes to internal network targets including AWS metadata; JavaScript aggregation functions execute arbitrary code on Historical and MiddleManager nodes (CVE-2021-25646 class vulnerability); ZooKeeper metadata storage accessible without authentication.
Read →Apache Pinot security testing: Controller port 9000 and Broker port 8099 expose REST and SQL APIs without authentication — any client executes SQL returning all table data, enumerates schemas, submits ingestion jobs from arbitrary URLs triggering SSRF, and deletes tables without authorization; web UI on port 9000 accessible without credentials; ZooKeeper stores all routing metadata without authentication on default deployments; multi-stage query engine can be abused for resource exhaustion.
Read →Metabase security testing: CVE-2023-38646 is a critical pre-authentication RCE affecting versions before 0.46.6.1 — unauthenticated attacker sends crafted H2 JDBC URL with INIT directive to /api/setup/validate using the setup token exposed at /api/session/properties; database credentials stored in application DB in recoverable format; public dashboard sharing provides unauthenticated access to full query result sets; native SQL query mode exceeds analyst permissions scope.
Read →DuckDB security testing: read_csv(), read_parquet(), and read_text() accept filesystem paths — user-controlled path input reads /etc/passwd, .env files, SSH keys, and config files; httpfs extension enables SSRF via SELECT * FROM read_csv('http://169.254.169.254/...') reading cloud metadata; ATTACH mounts other database files by path enabling cross-database access; glob() lists directory contents; SQL injection in DuckDB-backed APIs chains into all these filesystem primitives.
Read →Apache Solr security testing: Admin UI and REST API on port 8983 require no authentication by default — any client queries all collections and indexed data; CVE-2019-17558 Velocity template injection enables RCE by enabling VelocityResponseWriter via Config API then injecting Velocity expressions in query parameters; Log4Shell (CVE-2021-44228) severely impacted Solr versions before 8.11.1; DataImportHandler enables SSRF via crafted data source URLs; JMX port 18983 often unauthenticated.
Read →phpMyAdmin security testing: instances accessible at predictable paths (/phpmyadmin/, /pma/) with no IP restriction or with default root credentials allow full MySQL database access; CVE-2018-12613 local file inclusion in versions 4.8.0-4.8.1 allows RCE via session file inclusion; SELECT INTO OUTFILE writes PHP webshells when FILE privilege is granted; the /setup/ script accessible without auth enables SSRF by configuring arbitrary MySQL server connections; AllowArbitraryServer lets authenticated users pivot to internal MySQL hosts.
Read →Prometheus Alertmanager security testing: REST API on port 9093 requires no authentication by default — any network client views all active alerts and their metadata revealing infrastructure topology; silence creation via POST /api/v2/silences suppresses all production alert notifications for an attacker-controlled duration enabling undetected operation; /-/reload endpoint reloads routing config without auth; webhook receiver SSRF sends HTTP POST to any internal URL on each alert fire; gossip port 9094 exposes cluster membership.
Read →Redash security testing: admin credentials from initial setup phase often remain unchanged — weak passwords grant full admin access; the query API enables authenticated users to execute arbitrary SQL against all configured data sources which often include production databases; data source credentials (database passwords, AWS keys) accessible via /api/data_sources; URL query runner type enables SSRF to internal services from Redash workers; Python query runner allows arbitrary code execution on the worker process; embed tokens bypass authentication entirely for shared dashboards.
Read →Kibana security testing: instances without X-Pack security provide full Elasticsearch access via Dev Tools console — read all indices, execute arbitrary API calls, modify cluster settings; CVE-2019-7609 Timelion prototype pollution enables OS command execution on Kibana 5.6.15 and 6.6.1 and prior; saved objects reveal business data models and field mappings; index pattern enumeration exposes all stored data namespaces; /api/console/proxy SSRF reaches cluster nodes; audit logging typically absent without explicit X-Pack configuration.
Read →pgAdmin security testing: internet-accessible login at predictable paths with weak or default credentials grants full PostgreSQL administration from a browser; CVE-2023-5002 path traversal in pgAdmin 4 prior to version 7.6 allows authenticated users to read arbitrary server files via unsanitized SQLite path parameter; PostgreSQL superuser sessions enable COPY TO and pg_read_file() for server filesystem access; Python debugger interface allows executing arbitrary Python code on the pgAdmin server process; backup files written to web-accessible directories during export operations may be directly downloadable.
Read →Meilisearch security testing: instances launched without a master key have zero authentication — any client lists all indices, retrieves all documents page by page, and triggers full database exports via /dumps; search-only API keys embedded in client-side JavaScript for direct browser search give read access to all indexed content; master key exposure in JavaScript or environment dumps allows creating admin keys with full API permissions; /keys endpoint lists all API keys and their scopes when admin credentials are available; sensitive document fields accidentally indexed expose PII and business data via search API.
Read →Apache Superset security testing: CVE-2023-27524 (CVSS 9.8) — the default SECRET_KEY 'thisISaSECRET_1234' from Docker example configs allows flask-unsign session cookie forgery granting instant admin access without credentials; default admin/general credentials remain in many deployments; SQLAlchemy database URI injection allows connecting to arbitrary internal PostgreSQL/MySQL servers enabling SSRF and credential extraction; Jinja2 SQL templating enables template injection; database connection strings with embedded passwords accessible via the admin API.
Read →Adminer security testing: single-file PHP database admin at /adminer.php with no authentication gate — server field accepts any internal hostname enabling SSRF to reach internal MySQL/PostgreSQL/SQLite servers on the private network from the internet; rogue MySQL server attack via LOAD DATA LOCAL INFILE reads web server files when Adminer is pointed at attacker-controlled MySQL; CVE-2021-43008 path traversal (Adminer < 4.8.1) allows authenticated arbitrary file reads; database export files written to web-accessible directories during export operations; brute force of any reachable database via the Adminer form.
Read →Typesense security testing: search-only API key embedded in client-side JavaScript allows any user to enumerate all collections and export all indexed documents via /collections/{name}/documents/export without pagination limits; admin API key accidentally in JavaScript grants full control including collection deletion and new key creation; Typesense port 8108 directly accessible from internet enables bulk key testing; unscoped keys access all collections regardless of intended scope; sensitive data fields indexed in Typesense readable via standard search queries.
Read →n8n security testing: instances without authentication allow full workflow management via REST API; the Code node executes arbitrary JavaScript in Node.js with filesystem and network access — any user who can create workflows achieves RCE on the n8n server; stored credentials (API keys, OAuth tokens, database passwords) encrypted with N8N_ENCRYPTION_KEY — weak or default key allows decryption; execution history stores full workflow input/output data including sensitive processed records; webhook endpoints publicly accessible and triggerable with attacker-controlled data.
Read →Ghost CMS security testing: Admin API key in client-side JavaScript allows full content management including theme upload for Node.js server-side code injection; Content API with filter=status:draft exposes unpublished posts and scheduled content; member subscriber email addresses accessible via Admin API; Ghost admin panel publicly accessible enables credential brute force; webhook SSRF via admin-configured webhook URLs pointing to internal services; code injection via Settings > Code Injection inserts JavaScript into every page.
Read →Strapi security testing: all content type REST endpoints are publicly accessible by default until permissions are explicitly configured — new collections are open; CVE-2023-22621 SSTI in Strapi prior to 4.5.6 allows RCE via Lodash template injection in password reset email system; /api/auth/local/register open for public mass account creation; GraphQL introspection exposes complete content schema; admin panel at /admin accessible from internet; file upload accepts arbitrary MIME types without strict validation.
Read →Nextcloud security testing: /status.php reveals Nextcloud version and maintenance mode without authentication enabling targeted CVE exploitation; default admin/admin credentials in self-hosted deployments allow full administrative access to all user files; WebDAV endpoint at /remote.php/dav/ allows authenticated bulk file enumeration and download using standard WebDAV clients; public share tokens at /s/{token} disclosed in emails or links grant unauthenticated file access; external storage configurations pointing to sensitive server filesystem paths expose files outside intended Nextcloud data directory; OCS API lists all users with admin credentials.
Read →Directus security testing: the Public role with read permissions configured during development and forgotten in production exposes collection data without authentication; static API tokens embedded in frontend JavaScript give persistent access to all role-permitted collections; GraphQL introspection on /graphql reveals all collection names, field types, and relationships; file assets at /assets/{id} downloadable without authentication when Public role has file read permission; Directus Flow "Run Script" operations execute JavaScript on the server via Node.js JSVM accessible to admin users; admin credentials from Docker Compose examples (admin@example.com/password) commonly unchanged in self-hosted deployments.
Read →PocketBase security testing: admin dashboard at /_/ in setup mode allows any attacker who reaches the instance to create a superuser account with full control; collection API rules set to empty string during development allow all unauthenticated read/write operations; users collection readable without authentication exposes all user emails and profile data; JS hook system with $os bindings executes code on the PocketBase server accessible to admin users; uploaded files served at predictable /api/files/{collection}/{record}/{filename} paths downloadable without auth when view rule is open; no built-in rate limiting on authentication endpoints enables credential brute force.
Read →Matomo security testing: setup wizard accessible before admin creation allows attacker-controlled account takeover; token_auth API credentials passed in URL query string appear in server access logs enabling credential harvesting; tracking pixel url= parameter triggers server-side HTTP request enabling SSRF to internal services and cloud metadata endpoints; UTM campaign parameters and custom dimension values stored in database without sanitization enable stored XSS in admin reports; Live API exports visitor IP addresses and browsing history; some API methods accessible without authentication.
Read →Vaultwarden security testing: admin panel at /admin enabled with weak ADMIN_TOKEN grants full user management and vault administration; /identity/connect/token login endpoint has no rate limiting by default enabling password spraying against all registered user email addresses; vault API /api/ciphers with valid session returns all stored passwords, SSH keys, and notes in encrypted form — decryptable with master password; organization members with Manager/Owner permissions access all shared credentials in collections; db.sqlite3 database file direct access bypasses all application authentication.
Read →Uptime Kuma security testing: first-launch setup screen accessible to any visitor before admin account is created allows attacker to take full control of monitoring infrastructure; HTTP monitor type triggers server-side HTTP requests to configured URLs enabling SSRF to cloud metadata endpoints (169.254.169.254) and internal network services; public status pages expose monitored service names, target URLs, and uptime history without authentication; webhook notifications deliver monitor status data to attacker-controlled URLs; login endpoint without lockout enables credential brute force.
Read →Wiki.js security testing: setup wizard at /setup accessible before admin creation allows attacker to register admin account; GraphQL API at /graphql exposes full schema via introspection including administrative mutations for user management and permissions; storage backend configuration (Git, S3, Azure) enables SSRF to attacker-controlled endpoints during sync operations; authenticated GraphQL users.list query enumerates all wiki user emails; LDAP authentication with anonymous bind allows user enumeration without valid credentials.
Read →BookStack security testing: default admin@admin.com/password credentials documented in official install guide and frequently unchanged; REST API tokens with admin scope provide full read/write access to all books, chapters, and pages including sensitive documentation; ImageMagick MVG/MSL format upload SSRF when policy.xml restrictions are not configured; PDF export pipeline SSRF via wkhtmltopdf fetching page content URLs including attacker-controlled images; stored XSS via raw HTML in page content using TinyMCE editor.
Read →Coolify security testing: Docker socket mounted in Coolify container — web interface compromise = Docker daemon access = host root; SSH private keys for all managed remote servers stored in Coolify database enabling lateral movement; open user registration allows unauthorized resource deployment; application environment variables storing production secrets accessible to all admin users; wildcard subdomain DNS for deleted deployments enables subdomain takeover; exposed Docker API on host network ports grants unauthenticated container management.
Read →Appwrite security testing: server-side API keys with all.* scope embedded in client JavaScript bundles provide server-level access bypassing all collection permissions; database collections with 'any' or 'users' read permission expose all documents without ownership filtering to unauthenticated or any authenticated user respectively; storage buckets with public read allow unauthenticated file enumeration and download; Cloud Function environment variables exposed in verbose error messages; team role over-permission granting access beyond functional requirements.
Read →Netdata security testing: port 19999 dashboard and full metrics REST API accessible without authentication by default; /api/v1/info reveals hostname, OS version, RAM, CPU count, and Netdata version; process group charts expose all running software names and resource consumption; network connection charts reveal active connections and listening ports; stream.conf wildcard allow from directive accepts unauthorized child agent metric injection; alarm webhook URLs deliver monitoring event data to attacker-controlled endpoints.
Read →Passbolt security testing: /healthcheck endpoint exposes database connection status, GPG key configuration, PHP version, and SSL state without authentication; /api/v1/gpgkeys.json returns all registered user UIDs with email addresses unauthenticated enabling user enumeration; API JWT tokens from browser extension storage provide access to all passwords shared with the compromised user account; LDAP bind credentials for directory synchronization stored in Passbolt database; unrevoced account recovery links from offboarded users remain valid until consumed.
Read →Immich security testing: default admin@immich.app/password credentials documented in the official getting started guide grant access to all photos across every user account on the instance; per-user API keys stored in automation scripts give full photo, album, and metadata access via x-api-key header without session authentication; face recognition feature stores biometric face embedding vectors in PostgreSQL — unauthorized API access to /api/faces constitutes biometric data exposure with GDPR implications; shared album links at /share/{token} deliver all album photos without authentication to anyone with the URL; EXIF metadata in shared photos may contain GPS coordinates revealing location history.
Read →Seafile security testing: REST API authentication tokens from /api2/auth-token/ with weak admin credentials give full programmatic library read/write access; WebDAV interface at /seafdav authenticated with username/password allows bulk file enumeration and download bypassing normal Seafile permission enforcement; file download links at /f/{token}/ without password protection accessible to anyone with the URL and do not expire by default; admin panel credentials grant full cross-user library access; seahub SECRET_KEY compromise allows session forgery across all user accounts.
Read →Roundcube security testing: /installer/ directory accessible after installation reveals database credentials and IMAP server configuration in a web browser; Roundcube has a significant CVE history of stored XSS via HTML email including CVE-2023-5631 (SVG-based XSS in Roundcube < 1.6.4) executing attacker JavaScript in the victim's browser session when the email is opened; URL preview feature triggers server-side HTTP requests based on email link content creating SSRF to internal network services; HTML attachment preview enables credential phishing within the Roundcube interface; config.inc.php exposed via web server misconfiguration reveals database password and DES encryption key.
Read →PhotoPrism security testing: default admin/admin or admin/photoprism credentials documented in the quick start guide give full access to the AI photo library; Public mode (PHOTOPRISM_AUTH_MODE=public) disables all authentication making the entire photo library including GPS location data on the map view accessible without credentials; API session tokens and app passwords extracted from local storage give programmatic photo enumeration and download access; GPS EXIF coordinates indexed from all uploaded photos accessible via /api/v1/photos reveal complete location history; PreviewToken embedded in page source enables direct thumbnail URL construction.
Read →Jellyfin security testing: setup wizard accessible before admin account creation allows any visitor to claim the admin account and take full server control; user accounts with empty passwords created for household sharing authenticate with just the username via /Users/AuthenticateByName; API keys generated in the dashboard have no expiration date and provide full server access indefinitely — leaked keys from automation configs represent permanent access; DLNA/SSDP broadcasts server presence to all LAN devices on UDP port 1900 without authentication; /System/Info/Public always accessible revealing server name and version.
Read →Plex security testing: X-Plex-Token stored in plaintext in Preferences.xml and SQLite database gives complete library and admin access — single token = full server control; GDM (G'Day Mate) discovery broadcasts server presence on UDP ports 32412/32414 to all LAN devices without authentication; Plex relay routes traffic through Plex relay servers when direct connection fails exposing the server to the internet even without open firewall rules; "access without Plex account" PIN brute force with 4-8 digit codes; shared home user over-privilege allowing watch history access across household members.
Read →Home Assistant security testing: long-lived access tokens generated in User Profile provide permanent API access to all entities, automations, and physical device controls including locks and alarms with no expiry; webhook automation triggers at /api/webhook/{id} execute automations without any authentication — anyone who discovers the webhook ID can trigger home automation actions; SSH and terminal add-ons run with host network access enabling container escape from HA to the underlying host; trusted_networks authentication misconfiguration with overly broad CIDR bypasses password authentication for large network segments; direct internet exposure of port 8123 without VPN.
Read →Bitwarden self-hosted security testing: admin portal at /admin accessible with only the adminSettings__adminKey token — weak admin tokens give full user account management and organization vault access; bitwarden.override.env contains SMTP password, SQL Server connection string, and identity server keys in plaintext; /api/accounts/register open by default when disableUserRegistration not set allows anyone to create accounts; organization vault export API with admin token extracts all organization credentials in structured JSON format; identity server certificate password in bwdata/env gives JWT issuance capability.
Read →Syncthing security testing: GUI reconfigured to 0.0.0.0:8384 without authentication exposes full admin interface to all LAN users including folder management and device configuration; API key stored in config.xml gives full REST API access to add sync folders pointing to any filesystem path; REST API accessible without X-API-Key header when authentication is disabled; global discovery server reveals whether a specific device ID is currently online; relay server connection metadata including device IDs and data volumes observable by relay operators; sync folder path via API can point to sensitive directories for data exfiltration.
Read →FreshRSS security testing: admin interface at /i/ with weak credentials commonly set during installation gives full feed and user management; feed subscription triggers server-side HTTP requests to user-provided URLs enabling SSRF to cloud metadata endpoints (AWS IMDS 169.254.169.254, GCP metadata) and internal network services; Fever API token stored in p/api_key.txt on the filesystem is accessible when the data directory is web-accessible; Google Reader API at /api/greader.php accepts HTTP Basic Auth and can be brute-forced; OPML export reveals all subscribed feed URLs including any with embedded credentials or internal addresses.
Read →Paperless-ngx security testing: Docker Compose installation creates default admin/admin credentials giving full access to all archived sensitive documents (financial records, identity documents); POST /api/token/ returns persistent API token with valid credentials allowing programmatic listing, downloading, uploading and deleting all documents; Remote User authentication mode (PAPERLESS_ENABLE_HTTP_REMOTE_USER=true) can be bypassed by injecting Remote-User header if reverse proxy does not strip client-supplied headers; /consume/ directory write access allows injecting documents into the OCR pipeline; no rate limiting on /api/token/ enables credential brute force.
Read →Mealie security testing: default credentials changeme@example.com/MyPassword (admin@example.com/admin in older versions) documented in installation guides are frequently unchanged, giving JWT token via /api/auth/token with full admin access to all households and user accounts; recipe import feature at /api/recipes/create-url makes server-side HTTP requests to user-provided URLs enabling SSRF to cloud metadata services (AWS, GCP, Azure IMDS) and internal network services; open user registration when ALLOW_SIGNUP=true allows any visitor to create accounts; admin JWT exposes all households, user accounts, and recipe data across the multi-tenant instance.
Read →Pi-hole security testing: admin panel at /admin/index.php deployed without a password (the default) gives any LAN device full DNS configuration access; the REST API at /admin/api.php uses a single auth parameter equal to the double-MD5 hash of the admin password stored in setupVars.conf — this hash can be used directly for API access without knowing the plaintext password; with API access an attacker can whitelist malicious domains in the Gravity blocklist, inject custom DNS records redirecting hostnames to attacker IPs, retrieve DNS query logs exposing the browsing patterns of every LAN device, and disable all DNS filtering with a single API call.
Read →Calibre-Web security testing: default credentials admin/admin123 documented in installation guides give full admin access to user management and library settings; OPDS catalog at /opds provides access to the full e-book collection without credentials when OPDS authentication is not enforced — all books are browsable and downloadable by unauthenticated users; file upload interface triggers Calibre conversion tools server-side processing of user-supplied e-book files; /admin/user lists all registered users with email addresses; SQLite app.db when web-accessible exposes user account SHA256 password hashes and reading history.
Read →Gitea security testing: uncompleted installation at /install accessible when INSTALL_LOCK is not set allows any visitor to complete setup and claim admin credentials; webhooks trigger outbound HTTP requests to configured URLs on repository events creating SSRF to cloud metadata endpoints and internal network services; public repositories expose source code and accidentally committed secrets (API keys, credentials); OAuth applications allow registered users to harvest access tokens from other users who authorize them; default public repository visibility means newly created repositories may inadvertently expose internal code.
Read →Overseerr security testing: initial setup wizard at /setup uses Plex OAuth — if accessible before completion any visitor with a Plex account can claim admin ownership; local API key in Settings > General grants full programmatic access to user management, Radarr/Sonarr service credentials, and all request data; webhook notification feature makes outbound HTTP POST to configured URLs on media events creating SSRF to internal services and cloud metadata endpoints; Radarr and Sonarr API keys extractable via /api/v1/settings/radarr and /sonarr endpoints with admin API key.
Read →Authentik security testing: generated admin password printed to Docker logs on first startup must be retrieved and changed before setup; API tokens at /api/v3/ grant full identity provider management including user creation and group assignment across all SSO-protected services; LDAP outpost service account bind credentials stored in outpost configuration — compromise enables authentication as any user against all LDAP-integrated services; authentication flow policy bypass testing for MFA stage skipping via expression policy logic errors; OAuth/OIDC client secrets in application provider configuration.
Read →Gotify security testing: default admin/admin credentials give full access to all applications, tokens, and message history containing sensitive operational notifications (CI/CD output, security alerts, monitoring data); application tokens used by CI/CD pipelines and monitoring tools are non-expiring and frequently committed to version control; GET /message returns all stored notifications; WebSocket /stream with client token receives all future notifications in real time; POST /client creates additional persistent tokens that survive admin password changes, maintaining access.
Read →ntfy security testing: default server configuration allows unauthenticated subscription and publishing to any topic — auth-default-access=read-write means any visitor can receive all cached messages and subscribe to future notifications; topic names are the only access barrier and predictable names (alerts, monitoring, ci, docker) are discoverable from automation scripts committed to version control; GET /topic/json streams all messages without credentials; admin credential brute force on authenticated instances; server statistics reveal total message and topic counts.
Read →Audiobookshelf security testing: root admin account with weak password set during first-run wizard; JWT token from /login gives full library management, user creation, and server settings access; OPDS catalog at /opds accessible without credentials when allowOpdsWithoutCredentials=true (the default) exposes full audiobook collection for download; server backup download via /api/backups/download exposes complete database including all user accounts; admin can enumerate all user listening history and reading progress via the API.
Read →Kavita security testing: /register and /api/account/register accessible before admin created allows any visitor to claim admin control of the instance; weak admin credentials on /api/account/login return JWT token with full library and user management access; per-user OPDS API keys at /api/opds/{apiKey} provide persistent non-expiring library access without session authentication; admin JWT extracts all user OPDS API keys via /api/users endpoint; admin can access all libraries and user reading statistics regardless of per-library permission assignments.
Read →Portainer security testing: admin initialization endpoint /api/users/admin/init accessible for 5 minutes after first startup allows any visitor to set admin credentials and claim full Docker daemon control over all managed hosts; Portainer REST API accepts JWT tokens and API keys — admin access allows exec into any running container, volume creation mounting host filesystem paths, and environment inspection; Portainer stacks display environment variables in plaintext including database passwords and API keys; Portainer agent on port 9001 accepts Docker commands without mutual TLS authentication by default.
Read →Stirling PDF security testing: SECURITY_ENABLE_LOGIN is false by default — all 50+ PDF operations accessible via web UI and /api/v1/ without authentication; HTML-to-PDF conversion accepts URL parameter and makes server-side HTTP requests enabling SSRF to cloud metadata endpoints and internal services; file upload to LibreOffice conversion pipeline (DOCX/ODT format conversion) exposes server to maliciously crafted documents; Ghostscript PDF processing vulnerable to specially crafted PostScript/PDF inputs; OpenAPI spec at /v3/api-docs exposed without authentication revealing all available endpoints.
Read →Tautulli security testing: API key from Settings > Web Interface gives complete read access to all Plex viewing history for all users including IP addresses, device information, and watch duration via /api/v2?apikey=KEY; Tautulli stores the Plex owner's X-Plex-Token in config.ini in plaintext — this token provides full Plex Media Server API access including library management; notification agent webhooks make outbound HTTP POST requests to configured URLs on Plex stream events enabling SSRF; get_users API endpoint enumerates all Plex users with usernames and emails.
Read →Sonarr security testing: API key in Settings > General provides full instance control including access to all stored credentials; Sonarr stores API keys and passwords for all configured indexers (NZBGeek, NZBFinder, DrunkenSlug) in its SQLite database — /api/v3/indexer returns all indexer credentials in plaintext; Sonarr stores full connection details including username and password for all download clients (SABnzbd, qBittorrent, Deluge) — /api/v3/downloadclient exposes these credentials; notification agent configuration exposes Discord webhooks, Slack tokens, and email SMTP passwords.
Read →Homer dashboard security testing: config.yml served directly from web root at /assets/config.yml without any access controls — file commonly contains apikey fields for all integrated services including Sonarr, Radarr, Portainer, Grafana, and Home Assistant long-lived access tokens; Homer is a purely static web application with no built-in authentication mechanism — any authentication must be provided by a reverse proxy, and many deployments allow direct access; URL fields in config reveal full internal service topology including hostnames, IP addresses, and ports for every service in the environment.
Read →IT-Tools security testing: runs without any authentication by default — all 100+ developer utilities accessible to any user who can reach the instance including JWT parser, hash generators, base64 decoder, network calculators, and format converters; JWT decoder accessible without auth enables inspection of intercepted tokens without local tooling; server-side URL fetching capabilities (version-dependent) create SSRF to internal services; unauthenticated IT-Tools on an internal network reduces attacker tool acquisition burden providing immediate access to cryptographic and encoding utilities.
Read →Radarr security testing: API key in Settings > General provides full instance control including access to all stored credentials; /api/v3/indexer returns all configured indexer credentials including private tracker API keys and passkeys in plaintext; /api/v3/downloadclient exposes full connection credentials for qBittorrent, SABnzbd, Deluge, and Transmission; Import List feature performs server-side HTTP fetch to configured URL on each sync enabling SSRF to cloud metadata endpoints and internal services; Custom Script notification agent executes arbitrary scripts on the Radarr host when triggered.
Read →Jellyseerr security testing: API key in Settings > General gives full access to all service configurations including stored Plex auth token and Jellyfin API key; /api/v1/settings/plex and /api/v1/settings/jellyfin return media server credentials; /api/v1/settings/radarr and /api/v1/settings/sonarr return all arr stack API keys; /api/v1/user enumerates all registered users with email addresses and Plex usernames; notification webhooks fire on any request event enabling SSRF; any Plex/Jellyfin user can self-register and submit requests by default.
Read →Homarr security testing: admin credential brute force on /api/auth/callback/credentials — default credentials (admin/admin, admin/homarr) give full dashboard access; /api/config/default returns all board configurations including integration API keys for Sonarr, Radarr, qBittorrent, and Jellyfin; Docker socket integration exposes all container names, images, and states on the host Docker daemon; public boards expose integration widget API keys to unauthenticated users; homarr.db SQLite database stores all service credentials in plaintext.
Read →Prowlarr security testing: Prowlarr is the centralized indexer management hub storing credentials for every configured tracker in one place — GET /api/v1/indexer returns all indexer API keys, passkeys, and credentials for every configured NZB and torrent indexer; GET /api/v1/applications exposes API keys and base URLs for all connected *arr applications (Sonarr, Radarr, Lidarr, Readarr); single Prowlarr API key compromise gives access to the entire arr credential chain; test connection for indexers and applications triggers server-side HTTP to configured URLs enabling SSRF.
Read →qBittorrent security testing: web UI defaults to admin/adminadmin until changed — POST /api/v2/auth/login confirms default credentials; POST /api/v2/torrents/add with urls= parameter causes qBittorrent server to fetch the torrent file via server-side HTTP enabling SSRF; external program on torrent completion feature executes arbitrary commands on the host when any download finishes — accessible via /api/v2/app/setPreferences from anyone with API access; GET /api/v2/app/preferences reveals download save path and external program configuration.
Read →SABnzbd security testing: GET /api?output=json&mode=get_config returns the complete configuration including news server hostname, username, and password for all configured Usenet providers; GET /api?mode=get_config§ion=servers specifically extracts all server credentials; addurl mode triggers server-side HTTP to fetch NZB from the provided URL enabling SSRF to cloud metadata endpoints; sabnzbd.ini stores API key, NZB key, and all news server passwords in plaintext; unauthenticated localhost bypass allows any service on the same host to access SABnzbd without credentials.
Read →Bazarr security testing: GET /api/system/settings returns the full configuration including OpenSubtitles username/password, Subscene credentials, Addic7ed credentials, and API keys for every configured subtitle provider; the same endpoint exposes the Sonarr and Radarr API keys and base URLs stored for arr stack integration; subtitle download history endpoints reveal the complete TV show and movie library; bazarr.db contains all provider credentials and arr API keys in plaintext; no authentication by default means Bazarr is accessible to anyone who can reach the host.
Read →Lidarr security testing: GET /api/v1/indexer returns all configured indexer credentials including private tracker API keys and passkeys — identical architecture to Sonarr and Radarr; GET /api/v1/downloadclient exposes qBittorrent/SABnzbd/NZBGet credentials; GET /api/v1/notification exposes Custom Script agent configuration enabling code execution on the host by triggering a test notification; GET /api/v1/importlist returns Last.fm API tokens and other music metadata service credentials; same credential chain as the full arr stack.
Read →Readarr security testing: GET /api/v1/rootfolder returns Calibre Content Server credentials including host, port, username, and password stored for Calibre library integration; GET /api/v1/indexer exposes all indexer API keys and passkeys; GET /api/v1/downloadclient returns download client credentials; GET /api/v1/importlist exposes GoodReads and BookShelf API keys; Custom Script notification agent enables code execution on the host; same arr credential architecture as Sonarr, Radarr, and Lidarr with additional Calibre credential exposure.
Read →Proxmox VE security testing: runs as root with all API operations executing at bare-metal host level; API tokens in /etc/pve/user.cfg are long-lived and survive reboots; POST /nodes/{node}/qemu/{vmid}/vncproxy opens an interactive VNC console to any VM without VM-level authentication; POST /nodes/{node}/lxc/{ctid}/termproxy gives direct shell access to any LXC container; cluster nodes share /etc/pve meaning any cluster node compromise gives access to all API tokens for the entire cluster; GET /cluster/acme/plugins exposes DNS provider API credentials stored for certificate issuance.
Read →Nginx Proxy Manager security testing: defaults to admin@example.com/changeme as initial admin credentials — POST /api/tokens with these credentials returns a bearer token on unpatched installs; GET /api/nginx/proxy-hosts enumerates all internal service hostnames and IP addresses revealing the complete network topology; custom Nginx location blocks in proxy host advanced configuration inject arbitrary directives into the Nginx server block; SSL certificate private keys stored in the NPM data directory; HTTP Basic Auth access list credential hashes exposed via GET /api/nginx/access-lists.
Read →Watchtower security testing: requires /var/run/docker.sock mount giving root-equivalent access to the Docker daemon and all containers on the host; REPO_USER and REPO_PASS private registry credentials stored as environment variables visible via docker inspect; WATCHTOWER_HTTP_API_TOKEN static secret also visible in docker inspect environment; unauthenticated access to the HTTP API update endpoint when token is not configured; notification webhook URLs (Slack, MSTeams) and SMTP passwords exposed as environment variables.
Read →TrueNAS security testing: API key provides full root-level access equivalent to the root password; GET /api/v2.0/sharing/smb returns all share names, paths, and guest access settings; GET /api/v2.0/iscsi/auth returns iSCSI CHAP authentication usernames and secrets in plaintext; GET /api/v2.0/keychaincredential returns SSH private keys stored for replication tasks; cloud sync credentials (AWS S3, Backblaze B2) returned by /api/v2.0/cloudsync/credentials; TrueNAS API keys created in the web UI are long-lived root-equivalent tokens.
Read →Traefik security testing: built-in dashboard on port 8080 has no authentication by default, providing complete route and service inventory; GET /api/rawdata returns full routing configuration including backend service IPs; GET /api/http/middlewares exposes BasicAuth credential hashes; acme.json contains private keys for all Let's Encrypt certificates; DNS provider credentials (Cloudflare, Route53) visible via docker inspect as environment variables; Docker label injection risk from containers with routing labels.
Read →OpenVPN Access Server security testing: defaults to openvpn/openvpn as administrative credentials until explicitly changed; POST /rest/GetSessionToken with default credentials returns a session token; /rest/GetAutologin downloads complete .ovpn profile with embedded private key for any user; XML-RPC interface on port 943 provides full user enumeration and configuration management; userprop.db SQLite database contains user credentials on the filesystem; no MFA by default on user VPN accounts.
Read →WireGuard security testing: wg0.conf stores server PrivateKey in plaintext — a single root-level file read yields a key that decrypts all past and future VPN traffic; wg show reveals endpoint IP:port and last handshake for every active peer; PresharedKey fields per peer also stored in plaintext; PostUp/PostDown directives execute shell commands as root; /etc/wireguard/ directory permissions must be 700 to prevent non-root access; wg-easy and WireGuard-UI management UIs store peer configs and private keys in their own databases.
Read →UniFi Network Application security testing: older versions ran MongoDB on port 27117 without authentication, allowing direct extraction of all admin password hashes, WiFi PSKs, and SSH device credentials; GET /api/s/default/get/setting/mgmt returns x_ssh_username and x_ssh_password for all managed APs and switches in plaintext; GET /api/s/default/rest/wlanconf returns WiFi PSK passphrases and RADIUS secrets; default ubnt/ubnt admin credentials on unconfigured installs; .unf backup files contain all credentials in extractable format.
Read →Dozzle security testing: no authentication by default on port 8080; GET /api/hosts enumerates all containers across all Docker hosts without credentials; GET /api/logs/stream/{containerId} streams real-time container logs that frequently contain database passwords, API keys, JWT secrets, and SMTP credentials logged at startup; Docker socket mount gives root-equivalent Docker daemon access enabling container exec and environment variable extraction from all running containers; agent mode exposes logs from multiple Docker hosts through a single unauthenticated endpoint.
Read →Headscale security testing: API key in config.yaml provides full administrative access to all registered nodes and their WireGuard peer data; GET /api/v1/node returns all registered devices with WireGuard public keys, assigned VPN IPs, and last-seen timestamps; GET /api/v1/preauthkey lists all pre-auth keys including reusable unexpired keys enabling unlimited device joins; GET /api/v1/routes reveals all advertised subnets and internal network topology; config.yaml contains OIDC client secret, SMTP credentials, and database connection string.
Read →Ansible Semaphore security testing: GET /api/project/{id}/keys returns SSH private keys for all managed hosts in plaintext — one API token access yields SSH credentials to every server in the Ansible inventory; vault passwords for Ansible Vault-encrypted variables returned by same endpoint; GET /api/project/{id}/inventory reveals all managed hostnames and connection credentials; environment variable store exposes API keys and service credentials; task execution logs contain full Ansible playbook output including variable values.
Read →Graylog security testing: default admin/admin credentials on many installations; GELF UDP input on port 12201 accepts log data without authentication enabling log injection and source spoofing; GET /api/system/inputs reveals all configured log collection endpoints; root_password_sha2 in server.conf is an unsalted SHA-256 hash crackable offline; Elasticsearch connection credentials in server.conf; notification configurations expose webhook URLs and email SMTP credentials; API provides access to all historical security log data.
Read →Wazuh security testing: Wazuh API defaults to wazuh/wazuh credentials; GET /agents returns complete inventory of all monitored hosts with hostnames and IPs; client.keys at /var/ossec/etc/client.keys contains authentication keys for all registered agents enabling rogue agent registration and log injection; ossec.conf stores email SMTP credentials and syslog forwarder configuration; integration API keys for Slack, VirusTotal, and PagerDuty stored in plaintext; detection rules can be disabled via API to create blind spots in security monitoring.
Read →Woodpecker CI security testing: WOODPECKER_AGENT_SECRET in runner container environment enables rogue agent registration to intercept pipeline jobs and secrets; Docker runner mounts /var/run/docker.sock giving pipeline steps host root access; pipeline steps receive all secrets as environment variables logged when steps run env/printenv; GET /api/secrets lists all organization secrets by name; WOODPECKER_GITEA_SECRET OAuth credentials visible via docker inspect on server container; pipeline log audit for secret exposure commands.
Read →Forgejo security testing: admin API tokens access all users via GET /api/v1/admin/users and impersonate any user with sudo parameter; GET /api/v1/repos/search returns all private repositories; webhooks without secrets accept forged CI trigger deliveries; server-side Git hooks in repository .git/hooks/ execute shell commands as git service user on every push; Actions secrets accessible to all workflow steps; app.ini contains secret key, database credentials, and OAuth app secrets.
Read →OPNsense security testing: defaults to admin/opnsense on first boot; REST API authenticates with key/secret pairs stored in /conf/config.xml; full config backup exports complete XML file containing all firewall rules, WireGuard/OpenVPN private keys, user bcrypt hashes, and LDAP bind credentials in plaintext; Unbound DNS API allows host override injection for internal DNS poisoning; many deployments expose web UI on WAN interface; NAT rules reveal internal network topology.
Read →Netbird security testing: admin API token enumerates all peers with WireGuard public keys, IPs, and group memberships; setup keys allow unauthorized machine registration into the overlay network; /etc/netbird/netbird.conf stores WireGuard PrivateKey in plaintext; GET /api/routes reveals all internal subnets advertised through the overlay; ACL policies define peer communication rules; self-hosted management server has its own authentication surface for assessment.
Read →CrowdSec security testing: bouncer API keys in /etc/crowdsec/bouncers/ provide access to GET /v1/decisions full IP blocklist; /var/lib/crowdsec/data/crowdsec.db SQLite contains all machine and bouncer credential hashes; local_api_credentials.yaml stores plaintext machine password for LAPI auth; machine JWT enables decision injection to whitelist attacker IPs or block legitimate traffic; console enrollment token in config.yaml links instance to CrowdSec cloud hub.
Read →Zitadel security testing: bootstrap generates machinekey.json containing RSA private key for system admin service account — no password required; JWT from machine key exchanges for admin access token with full IAM control; admin API enumerates all users and organizations; ZITADEL_MASTERKEY in container environment decrypts all database secrets including OIDC client credentials; service account key files provide permanent authentication without passwords.
Read →Mattermost security testing: admin tokens provide GET /api/v4/users full user enumeration and POST /api/v4/posts/search credential keyword scanning across all channels and DMs; config.json stores LDAP bind passwords, SMTP credentials, and database connection string in plaintext; incoming webhooks with EnablePostUsernameOverride allow message spoofing; bot tokens in Docker Compose files enable cross-channel access; bulk export captures all historical messages.
Read →Apache Guacamole security testing: defaults to guacadmin/guacadmin; GET /api/session/data/mysql/connections/{id}/parameters returns all stored RDP passwords, SSH private keys, and VNC credentials for every configured server; guacamole.properties stores database and LDAP bind passwords in plaintext; connection list maps complete internal server infrastructure; active session enumeration enables token reuse for session hijacking on vulnerable versions.
Read →DefectDojo security testing: defaults to admin/admin; GET /api/v2/findings returns complete vulnerability database with CVEs, CVSS scores, and endpoints for all products; POST /api/v2/import-scan with close_old_findings=true injects false findings and corrupts remediation tracking; Django admin /admin/ provides direct database model access; DD_SECRET_KEY in container environment enables session token forgery; JIRA and Slack credentials stored in system settings database.
Read →TheHive SOAR platform security testing: defaults to admin@thehive.local/secret; API key provides POST /api/v1/query access to all incident cases with IOCs, observables, and investigation notes; Elasticsearch backend on port 9200 may be unauthenticated, bypassing all application RBAC; application.conf stores Cortex API key and MISP authentication key; case data exposes complete incident intelligence including affected systems and response actions.
Read →LibreNMS network monitoring security testing: defaults to admin/admin; GET /api/v0/devices returns complete network inventory with IP addresses and SNMP community strings for every monitored device; SNMP v2c community strings enable independent device polling for routing tables and ARP caches; config.php stores MySQL database password; alert transport database contains Slack webhooks and PagerDuty API keys; Oxidized integration stores SSH/Telnet credentials for all network devices.
Read →Checkmk infrastructure monitoring security testing: defaults to cmkadmin/cmkadmin; REST API GET /api/1.0/domain-types/host_config/collections/all returns all monitored hosts with IPs and configurations; automation user secret in ~/var/check_mk/web/automation/ provides full API access; WATO configuration stores LDAP bind credentials; passive check injection via API suppresses real alerts; maintenance window enumeration reveals optimal attack timing windows.
Read →NetBox IPAM and network documentation security testing: unauthenticated API access when LOGIN_REQUIRED=False returns all IP allocations and device inventory; Django SECRET_KEY in configuration.py enables session token forgery; GET /api/ipam/ip-addresses/ maps complete IP space with management addresses; GET /api/dcim/devices/ reveals hardware inventory with rack locations; webhook configurations store Slack and PagerDuty API keys; custom scripts execute as Django process with database access.
Read →GLPI IT asset management security testing: 4 default accounts (glpi/glpi superadmin, tech/tech, normal/normal, post-only/postonly); REST API GET /apirest.php/Computer returns complete hardware inventory; Active Directory bind password in config_ldap MySQL table; historical SQL injection CVEs in search parameters (CVE-2022-35914); config_db.php stores database credentials; plugin installation enables PHP webshell deployment to web-accessible directory.
Read →Zammad helpdesk security testing: REST API token GET /api/v1/tickets returns all support tickets with full conversation history and customer data; GET /api/v1/users enumerates all customer accounts; LDAP bind credentials in PostgreSQL settings table; email channel IMAP/SMTP passwords in channels table; Rails secret_key_base in /etc/zammad/ enables session cookie forgery for any user; Elasticsearch backend may be accessible without authentication.
Read →phpIPAM IP address management security testing: defaults to admin/ipamadmin; REST API GET /api/{appid}/subnets/ returns all subnet allocations with VLAN info and SNMP community strings; GET /api/{appid}/addresses/ maps all allocated IPs with hostnames and notes; config.php stores MySQL database password; SNMP v2c community strings per subnet enable direct device polling; custom fields and address notes frequently contain plaintext credentials documented by network engineers.
Read →Icinga infrastructure monitoring security testing: default root/icinga API user; REST API GET /v1/objects/hosts returns all monitored hosts with IPs and custom variables; resources.ini stores MySQL/PostgreSQL passwords for all databases (IDO, Director, web); passive check POST /v1/actions/process-check-result suppresses real monitoring alerts; Icinga 2 CA key at /var/lib/icinga2/ca/ca.key enables signing rogue agent certificates; setup.token may remain active post-installation.
Read →Snipe-IT IT asset management security testing: REST API GET /api/v1/hardware returns all hardware assets with serial numbers and employee assignments; GET /api/v1/licenses returns all software licenses with serial keys including enterprise volume license keys for Microsoft, Adobe, and other commercial software; Laravel APP_KEY in .env enables encrypted field decryption and session cookie forgery; LDAP bind credentials in .env and settings table; no per-user API token scoping in Community Edition.
Read →Cacti network monitoring security testing: CVE-2022-46169 pre-authentication RCE via /cacti/remote_agent.php X-Forwarded-For header command injection affecting all versions prior to 1.2.23 (CVSS 9.8); default admin/admin credentials; SQL injection in graph and search parameters (CVE-2023-39362); config.php stores MySQL database password; SNMP community strings per monitored device in the MySQL host table; actively exploited in the wild against internet-exposed deployments.
Read →Observium auto-discovering network monitoring security testing: default admin/admin; API GET /api/v0/devices/ returns all auto-discovered network devices with OS types, hardware models, and locations; MySQL devices table stores SNMP community strings and SNMPv3 credentials for every auto-polled device; ARP and routing table data exposes complete internal network topology; config.php stores MySQL password and default SNMP community strings used for discovery; Community Edition has no role-based access control.
Read →Mattermost team messaging security testing: API token GET /api/v4/channels/{id}/posts returns complete message history for all channels including direct messages; incoming webhook URLs allow channel posting without authentication; admin token GET /api/v4/config returns config.json contents including SqlSettings.DataSource database password, SMTP credentials, and LDAP bind password; unauthenticated user enumeration via /api/v4/users on misconfigured instances; outgoing webhook token extraction from custom integrations.
Read →Discourse community forum security testing: /about.json exposes admin and moderator usernames without authentication; API key GET /admin/users/list returns all user accounts with email addresses and registration IPs; GET /admin/site_settings.json exposes sso_secret for DiscourseConnect bypass; app.yml stores PostgreSQL password, Redis password, and secret_key_base for session forgery; private messages accessible via admin API; public user profiles at /u/{username}.json enable account enumeration.
Read →OpenProject project management security testing: defaults to admin/admin; REST API GET /api/v3/work_packages returns all work packages across all accessible projects; GET /api/v3/attachments provides download URLs for all uploaded project documents; ldap_auth_sources PostgreSQL table stores LDAP bind DN and password; configuration.yml contains database password and secret_key_base for session forgery; admin API token enumerates all users with email addresses; project visibility misconfiguration exposes confidential project data.
Read →Rocket.Chat team messaging security testing: default admin/admin; REST API POST /api/v1/login returns auth token for full channel and DM access; GET /api/v1/channels.messages reads complete channel message history; MongoDB rocketchat integrations collection stores incoming webhook tokens for unauthenticated channel posting; rocketchat_settings collection has LDAP_Bind_Password; Docker deployments may expose ADMIN_PASS via docker inspect; users collection has bcrypt password hashes.
Read →Redmine issue tracking security testing: defaults to admin/admin; REST API key GET /issues.json returns all issues across all projects including private; GET /users.json with admin key enumerates all users with emails; config/database.yml production.password in plaintext; auth_sources table stores LDAP bind DN and account_password (plaintext in older versions); config/initializers/secret_token.rb contains Rails secret_key_base for session cookie forgery for any user.
Read →ERPNext and Frappe ERP security testing: default Administrator/admin; Frappe REST API GET /api/resource/Employee returns all employee PII including DOB and bank account numbers; GET /api/resource/Salary Slip exposes payroll data; common_site_config.json stores MySQL db_password; site_config.json encryption_key decrypts all Frappe-encrypted database fields; User DocType exposes api_key and api_secret for all API users in plaintext; DocType permission misconfiguration enables unauthorized financial and HR data access.
Read →Dolibarr ERP/CRM security testing: admin/admin default; SQL injection in product search and thirdparty search parameters (CVE-2023-4197 CVSS 8.8 authenticated SQL injection and prior CVEs); REST API GET /api/index.php/thirdparties returns all customers and suppliers; GET /api/index.php/invoices returns all invoices with financial totals; conf.php dolibarr_main_db_pass MySQL password in plaintext; PHP file manager module enables webshell upload to web-accessible upload directory; ECM module file upload security assessment.
Read →Odoo ERP security testing: /web/database/manager may be publicly accessible enabling database backup download and restoration without master_password; XML-RPC /xmlrpc/2/common authenticate() and /xmlrpc/2/object execute_kw() for full ERP data access; admin/admin default in many deployments; execute_kw on res.partner returns all customers, account.move all invoices, hr.employee all employee PII including private email and birth date; odoo.conf admin_passwd (master password) and db_password (PostgreSQL) in plaintext.
Read →LimeSurvey security testing: admin/password default; authenticated admin plugin upload at /index.php/admin/pluginmanager/sa/upload achieves PHP webshell RCE via ZIP containing shell.php; RemoteControl2 JSON-RPC API get_session_key() + export_responses() exports all survey responses including participant PII; config.php MySQL db_password in PHP array; lime_participants table stores respondent personal data; lime_survey_XXXXXX tables contain all survey response data; upload/plugins/ directory may allow PHP execution if web server not configured to prevent it.
Read →Taiga agile project management security testing: default superuser created during setup often uses weak credentials (admin/123123); REST API POST /api/v1/auth returns auth_token; GET /api/v1/projects lists all projects with member counts; GET /api/v1/users returns all users with email addresses; GET /api/v1/userstories returns complete backlog; Django admin at /admin/ provides superuser database access; config.py SECRET_KEY enables Symfony session forgery; PostgreSQL DATABASE password in settings/local.py; media files may be publicly accessible without authentication.
Read →SuiteCRM CRM security testing: admin/admin default; REST API v8 GET /api/v8/module/Accounts returns all customer accounts; GET /api/v8/module/Contacts returns all contact PII; GET /api/v8/module/Opportunities exposes full sales pipeline with revenue values; config.php db_password MySQL password; OAuth 2.0 client_secret stored in plaintext in oauth2clients table; Module Loader authenticated RCE via PHP ZIP upload; sugar.log debug logging may contain database credentials; legacy REST API v4.1 still active in many installations with MD5 password hashing.
Read →Kimai time tracking security testing: .env DATABASE_URL stores MySQL password as full DSN; APP_SECRET Symfony secret enables remember-me cookie forgery for any user; REST API GET /api/timesheets returns all time records with billing rates and descriptions; GET /api/customers returns all customer data with billing rates and budgets; GET /api/users returns all users with roles and emails; API tokens stored in kimai2_user_preferences table in plaintext; /api/doc.json API schema publicly accessible for endpoint enumeration; log file may expose database query data in debug mode.
Read →Monica personal CRM security testing: .env APP_KEY Laravel encryption key decrypts all Crypt::encrypt() database fields and enables session cookie forgery for any user; REST API GET /api/contacts returns all personal contacts; GET /api/notes returns highly sensitive personal relationship notes that may contain health, financial, and life details; GET /api/activities returns complete relationship activity log; GET /api/reminders returns personal schedule; .env DB_PASSWORD MySQL; personal_access_tokens SHA-256 hashed API tokens; open registration testing for unauthenticated account creation.
Read →MantisBT bug tracker security testing: administrator/root default credentials; REST API GET /api/rest/issues returns all project issues including private and confidential security vulnerability bug reports; config_inc.php g_db_pass MySQL password and g_crypto_master_salt; mantis_user_table bcrypt password hashes; file attachment upload directory may allow PHP webshell execution if web-accessible; anonymous API access may be enabled; SOAP API (mantisconnect.php?wsdl) active in older installations; bug trackers frequently contain unpatched security vulnerability details.
Read →Invoice Ninja billing platform security testing: .env STRIPE_SECRET live payment gateway key enables creating charges, listing customers, and processing refunds via Stripe API directly; APP_KEY Laravel encryption key decrypts stored client tax IDs and payment tokens; REST API GET /api/v1/clients returns all clients with balances; GET /api/v1/invoices all invoices; GET /api/v1/payments all payment records; multi-company data isolation bypass testing; client portal invitation key enumeration; .env DB_PASSWORD MySQL; payment gateway credential extraction (Stripe, PayPal).
Read →WeKan kanban board security testing: admin/admin default credentials; REST API POST /users/login returns authToken and userId; GET /api/boards returns all boards including private project boards; GET /api/boards/{id}/lists returns all lists; GET /api/boards/{id}/lists/{id}/cards returns all cards with task content and descriptions; MONGO_URL environment variable contains MongoDB connection string with credentials; MongoDB may be accessible without authentication if bound to 0.0.0.0 without --auth; GET /api/users returns all registered users with emails; board permission misconfiguration testing for inadvertent public board exposure.
Read →Flarum forum platform security testing: admin credentials set during setup wizard with no complexity enforcement; JSON:API POST /api/token returns Bearer access token; GET /api/discussions returns all forum discussions; GET /api/posts returns all posts including soft-deleted content; GET /api/users with admin token returns all users with email addresses; config.php stores MySQL database password in PHP array; flarum_access_tokens table contains plaintext Bearer tokens for all users; admin API token enables creating users and modifying admin flag; extension ecosystem audit for file upload and custom API endpoint vulnerabilities; rate limiting verification on /api/token endpoint.
Read →FusionAuth authentication platform security testing: admin credentials set during setup; API key POST /api/user/search with queryString:* returns all users across all tenants; GET /api/application returns all applications with OAuth 2.0 client secrets; GET /api/key returns HMAC secret values and RSA private key PEM enabling JWT forgery for all dependent applications; fusionauth.properties database.password PostgreSQL credentials; api_keys table stores plaintext API key values; admin panel network exposure testing; cross-tenant data isolation bypass testing; OAuth 2.0 client secret enumeration enabling application impersonation.
Read →Phabricator development platform security testing: Conduit API POST /api/user.whoami token authentication; /api/maniphest.search all tasks including private security bugs; /api/differential.revision.search all code reviews with source code diffs; /api/diffusion.repository.search all repositories with clone URIs; /api/user.search all users with emails; conf/local/local.json mysql.pass database password; phabricator_conduit.conduit_token table all active API tokens; phabricator_user.user table bcrypt password hashes; Diffusion repository unauthenticated clone testing.
Read →Mautic marketing automation security testing: admin credentials set during installation; OAuth 2.0 POST /oauth/v2/token returns Bearer access token; GET /api/contacts returns all contacts with emails and behavioral tracking data (page visits, email opens, link clicks); GET /api/campaigns all marketing campaigns; GET /api/emails all email templates with send history; app/config/local.php database_password MySQL credentials; oauth2_access_tokens table stores plaintext Bearer tokens; leads table complete customer database with scoring; users table SHA-512 hashed passwords.
Read →OpenCart e-commerce security testing: admin/admin default credentials; admin directory path enumeration when not renamed; GET /install/ accessibility — HTTP 200 enables full database reset and admin account creation; config.php and admin/config.php DB_PASSWORD MySQL constants; oc_customer table customer emails and bcrypt password hashes; oc_order all customer orders with shipping addresses and totals; oc_api API keys stored in plaintext; extension file upload PHP RCE testing for web-accessible upload paths; robots.txt admin path disclosure; web server misconfiguration exposing config.php source.
Read →Outline team wiki security testing: .env SECRET_KEY 32-byte session signing key enables forging session cookies as any user bypassing Slack/Google SSO; AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY S3 document storage credentials; SLACK_CLIENT_SECRET and GOOGLE_CLIENT_SECRET OAuth application secrets; DATABASE_URL PostgreSQL connection string with password; POST /api/documents.list returns all team documents; POST /api/documents.export returns full Markdown content of any document; POST /api/users.list all users with emails; POST /api/collections.list all collections including private ones.
Read →NocoDB no-code Airtable-alternative security testing: admin@example.com/password default credentials in Docker deployments; NC_AUTH_JWT_SECRET JWT signing secret enables token forgery for any user; GET /api/v1/db/meta/projects returns all bases; GET /api/v1/db/data/noco/{base}/{table} all table records; SQLite metadata database /usr/app/data/noco.db stores external database connection strings with passwords; /swagger Swagger UI may be accessible without authentication; xc_users table bcrypt password hashes; NC_ADMIN_EMAIL/NC_ADMIN_PASSWORD environment variable exposure.
Read →Chatwoot customer support platform security testing: admin credentials set during installation; SECRET_KEY_BASE Rails session signing key enables cookie forgery for any agent; POST /auth/sign_in returns access_token; GET /api/v1/accounts/{id}/conversations all customer conversations across all channels; GET /api/v1/accounts/{id}/contacts all contacts with emails and phone numbers; DATABASE_URL PostgreSQL with all conversation history; inbox integrations store email passwords, WhatsApp API keys, Twilio tokens, and Slack bot tokens in database; /super_admin panel manages all Chatwoot accounts.
Read →Cal.com scheduling platform security testing: NEXTAUTH_SECRET Next.js JWT session signing key enables forging session cookies as any user bypassing Google/SAML SSO; GOOGLE_CLIENT_SECRET OAuth app impersonation; STRIPE_PRIVATE_KEY live Stripe API access for listing customers, creating charges, and modifying subscriptions; DATABASE_URL PostgreSQL connection string; GET /api/v1/bookings all scheduled meetings with attendee names and emails; GET /api/v1/users all users; CredentialKey table stores OAuth access_token and refresh_token for Google Calendar, Zoom integrations; SMTP password extraction for email service impersonation.
Read →Plane project management platform security testing (Linear/Jira alternative): SECRET_KEY Django session signing key enables forging cookies as any user; GET /api/v1/workspaces all workspaces; GET /api/v1/workspaces/{slug}/projects all projects; GET /api/v1/workspaces/{slug}/projects/{id}/issues all issues with descriptions and content; GET /api/v1/workspaces/{slug}/members all team member emails; DATABASE_URL PostgreSQL connection string; api_tokens table stores plaintext token values; Docker environment variable credential exposure; workspace network visibility misconfiguration; cross-workspace access isolation testing.
Read →Infisical secrets management platform security testing (HashiCorp Vault alternative — stores all other apps' credentials): ENCRYPTION_KEY AES-256-GCM decryption key for all stored secrets enabling mass credential harvest across all integrated applications; JWT_SECRET session token forgery; MONGO_URL MongoDB credentials with all secret ciphertext; GET /api/v3/secrets returns all plaintext secret values by workspace; machine identity tokens provide non-expiring API access; GET /api/v1/admin/user-management all users; admin can read any workspace secrets; CredentialKey OAuth token extraction; service token privilege audit.
Read →Baserow no-code database platform security testing (Airtable alternative): SECRET_KEY Django session signing key enables forging cookies as any user; GET /api/database/rows/table/{id} all table rows including all user-defined data fields; GET /api/applications all workspace databases and table structures; GET /api/user/admin/users all registered users with emails and last login; database_token table stores plaintext API token values; DATABASE_URL PostgreSQL connection string; Docker environment variable exposure; public registration misconfiguration; workspace isolation bypass testing.
Read →Windmill workflow automation platform security testing: admin@windmill.dev/changeme documented default credentials enable full admin access including arbitrary script execution; GET /api/w/{workspace}/scripts/list all scripts with source code; POST /api/w/{workspace}/jobs/run/p/{path} execute any script in the Windmill worker; GET /api/w/{workspace}/jobs/completed/list all job execution history and outputs; variable table stores plaintext non-secret variables; resource table stores integration credentials (GitHub tokens, database passwords, OAuth secrets) as JSON; token table worker tokens extraction including non-expiring values; DATABASE_URL PostgreSQL credential extraction.
Read →Zitadel IAM platform security testing (Keycloak/Auth0 alternative — controls all authentication): MASTER_KEY AES-256-GCM decryption key for OIDC signing keys stored in database; decrypted RSA signing keys enable forging valid JWTs for every connected application — catastrophic blast radius; default zitadel-admin@zitadel.localhost credentials; POST /management/v1/users/_search all users; POST /management/v1/apps/_search all OAuth applications with client IDs; machine account RSA key file extraction; encryption_keys table OIDC signing key ciphertext; human_users table password hashes; app_oidc_configs OAuth client credentials; CockroachDB/PostgreSQL connection credential extraction.
Read →Docmost collaborative document editor security testing (Notion/Confluence alternative): APP_SECRET JWT signing key enables forging authentication tokens as any user; GET /api/spaces all workspace spaces with visibility settings; GET /api/pages all document pages and titles; GET /api/pages/{id} full document content including sensitive internal policies; GET /api/workspaces/members all users with emails; DATABASE_URL PostgreSQL all document content and user accounts; REDIS_URL active session token access; SMTP credential extraction for email service impersonation; space visibility misconfiguration testing.
Read →Appsmith low-code internal tools platform security testing: APPSMITH_ENCRYPTION_PASSWORD and APPSMITH_ENCRYPTION_SALT decrypt all datasource credentials (database passwords, API keys, OAuth secrets) stored in MongoDB — mass credential harvest; superuser@appsmith.com documented default admin; GET /api/v1/datasources all connected databases with connection strings; POST /api/v1/datasources/{id}/test validates credentials confirming active access; GET /api/v1/applications all internal tools with page structures; MongoDB datasource collection direct access; public application access misconfiguration; user email harvesting via admin API.
Read →Budibase low-code platform security testing: JWT_SECRET signs auth tokens enabling session forgery as any user; API key (x-budibase-api-key header) provides full admin access without password; GET /api/applications all internal tools; GET /api/datasources all connected databases with connection credentials (may be plaintext); GET /api/global/users all platform users with emails; CouchDB COUCHDB_PASSWORD direct database access to all app databases; app database datasource documents contain connection strings; MinIO/S3 access key extraction; CouchDB admin party mode testing; Docker environment variable credential exposure.
Read →Gitness (Harness Open Source) Git hosting and CI/CD platform security testing: pipeline secrets (API keys, registry credentials, deployment tokens) stored in database accessible via API; GET /api/v1/secrets all CI/CD pipeline secret identifiers and values; GET /api/v1/spaces all organizations and repository counts; GET /api/v1/repos all repositories with visibility settings; GET /api/v1/admin/users all platform users with emails; GITNESS_JWT_SECRET JWT signing key enables token forgery as any user; SQLite gitness.db tokens, users, secrets, and webhook HMAC secrets; Docker environment variable credential exposure; pipeline execution log secret value leakage.
Read →PostHog product analytics platform security testing: SECRET_KEY Django secret key enables session cookie forgery as any user; personal API key provides full organization-level access to all analytics data; GET /api/projects/{id}/session_recordings all user session recordings (may contain unmasked passwords and sensitive inputs); GET /api/projects/{id}/persons all identified users with email addresses and behavioral properties; ClickHouse events table all captured behavioral events; PostgreSQL posthog_personalapikey all API key hashes; Docker env var exposure; session recording PII and sensitive form data capture misconfiguration.
Read →Umami web analytics platform security testing (Google Analytics alternative): admin/umami documented default credentials provide immediate admin access; APP_SECRET JWT signing secret enables token forgery as any platform user; GET /api/websites all tracked websites with domains and share tokens; GET /api/websites/{id}/sessions all visitor sessions with country, city, browser, OS, referrer data; GET /api/users all platform users; share_id database enumeration for public analytics access; PostgreSQL/MySQL umami schema session and event tables; Docker APP_SECRET environment variable exposure; competitor traffic analysis via analytics data unauthorized access.
Read →OpenReplay session replay platform security testing (Hotjar/FullStory alternative): JWT_SECRET signs authentication tokens enabling session forgery as any user; session recordings capture keystrokes in all input fields (may include unmasked passwords, credit card numbers, OTPs); network request capture stores Authorization headers with Bearer tokens and API keys from authenticated user sessions; GET /api/v1/projects/{id}/sessions all recorded sessions with user identifiers; PostgreSQL API key enumeration from users table (plaintext); MinIO/S3 credential extraction for all session recording storage; save_request_payloads configuration enables request body capture.
Read →Leantime project management platform security testing (Jira/Linear alternative): admin@admin.com/admin commonly reported default credentials; session secret enables PHP session cookie forgery as any user; JSON-RPC API leantime.rpc.Projects.getAll all projects; leantime.rpc.Tickets.getAll all task details; MySQL zp_users.apiKey stores API keys in plaintext — complete credential harvest; OIDC client secret extraction from zp_settings table for SSO provider impersonation; LEAN_SESSION_PASSWORD Docker env var; SMTP credentials in configuration.php; file upload restrictions bypass testing.
Read →Huly all-in-one workspace platform security testing (Linear/Notion/GitHub alternative): SECRET environment variable signs authentication tokens enabling forgery as any workspace user; MongoDB MONGO_URL credential extraction provides access to all workspace data including user accounts, projects, documents, and communications; MinIO MINIO_ACCESS_KEY + MINIO_SECRET_KEY access all uploaded files and attachments; workspace member email enumeration via API; Elasticsearch search index exposes all indexed workspace content without authentication when deployed without X-Pack Security; workspace invitation token abuse for unauthorized workspace access.
Read →Twenty CRM security testing (Salesforce/HubSpot open-source alternative): APP_SECRET JWT signing key enables token forgery as any workspace member; GraphQL introspection reveals all CRM object types for targeted data extraction; GraphQL queries people{id name emails phones} all contacts with email/phone; companies{name domainName annualRecurringRevenue} all accounts with ARR; opportunities{name amount stage closeDate} all deal pipeline values; PostgreSQL PG_DATABASE_URL workspace.person/company/opportunity direct access; core.apiKey table API key hash enumeration; Redis session token access; Docker env var exposure.
Read →Formbricks survey and experience management platform security testing (Typeform/SurveyMonkey alternative): NEXTAUTH_SECRET session token forgery as any platform user; ENCRYPTION_KEY extracts all application-layer encrypted data from PostgreSQL; GET /api/v1/management/responses all survey submissions with PII (names, emails, health data, financial feedback); GET /api/v1/management/contacts all respondent emails; PostgreSQL Response.data JSON column all raw form submissions bypassing API controls; Docker environment variable NEXTAUTH_SECRET/DATABASE_URL/ENCRYPTION_KEY exposure; API key enumeration.
Read →Activepieces workflow automation platform security testing (Zapier/Make open-source alternative): ENCRYPTION_KEY decrypts every stored OAuth token and API key for all connected services (Slack workspace tokens, Gmail OAuth, Stripe live keys, Salesforce, HubSpot, GitHub); mass credential harvest from single key extraction; JWT_SECRET token forgery as any platform user; GET /api/v1/app-connections all connections with service names; PostgreSQL app_connection.value AES-encrypted credential blobs; flow run logs may expose OAuth callback data and webhook payloads; Docker env var ENCRYPTION_KEY + JWT_SECRET exposure.
Read →Flowise LangChain/LlamaIndex UI security testing: unauthenticated API access in default deployments (no FLOWISE_USERNAME/PASSWORD set); GET /api/v1/chatflows all AI chatflows including embedded LLM node configurations; GET /api/v1/credentials all stored LLM API key metadata (OpenAI, Anthropic, Azure, Pinecone, Weaviate); FLOWISE_SECRETKEY_OVERWRITE AES-CTR decryption of all stored credentials; SQLite credential table with encryptedData blobs; chatflow API key plaintext in apikey table; Docker env var FLOWISE_USERNAME/PASSWORD exposure; chatflow prompt injection for system prompt and credential exfiltration.
Read →AnythingLLM LLM document chat platform security testing: JWT_SECRET token forgery as any platform user; single-user mode password brute force (no username required); GET /api/v1/workspaces all workspaces with document metadata; GET /api/v1/workspace/{slug}/chats complete conversation history for all users; SQLite system_settings LLM provider API keys in plaintext (OpenAI, Anthropic, Azure, Cohere); api_keys table all API keys; STORAGE_DIR/documents/ plaintext JSON of all uploaded document content; workspace chat prompt injection for document and system prompt exfiltration; Docker STORAGE_DIR and JWT_SECRET exposure.
Read →Dify LLM application development platform security testing (Python/Flask): SECRET_KEY Flask session cookie forgery; ENCRYPT_SECRET_KEY AES-GCM decryption of all LLM provider API keys in provider_models PostgreSQL table (OpenAI, Anthropic, Azure OpenAI, Google, Cohere); app API tokens (app-xxxx) stored plaintext in api_tokens table; GET /console/api/apps all AI applications with system prompts; GET /console/api/apps/{id}/model-config system prompt IP extraction; GET /console/api/apps/{id}/conversations all user conversation history; PostgreSQL accounts table user password hashes; MinIO knowledge base document storage credential extraction.
Read →Docuseal document signing platform security testing (DocuSign/HelloSign alternative): JWT_SECRET signs signer completion tokens embedded in invitation email links — forging enables bypassing signer email requirement; SECRET_KEY_BASE Rails session forgery as any admin; API GET /api/submissions all signed documents with signer PII (name, email, phone, IP, user agent, signing timestamp); signed PDF download without additional auth; PostgreSQL submitters table complete signer legal records; submission_values all form field responses including signature images, typed names, dates; S3/MinIO signed document storage access; GDPR data breach risk covering all historical signers.
Read →GlitchTip Sentry-compatible error tracking platform security testing (Django): SECRET_KEY Django session cookie forgery; open user registration by default (ENABLE_OPEN_USER_REGISTRATION=true); DSN key extraction from projects_projectkey enables unauthenticated event injection; GET /api/0/issues/{id}/events/latest/ full stack traces with source code context_line snippets; server environment variables captured in error context may contain DATABASE_URL, SECRET_KEY, API keys; HTTP request headers in events may include Authorization/Cookie; PostgreSQL issue.data JSON blob all error telemetry; breadcrumbs reveal user behavior sequences; DSN abuse for alert fatigue and misleading error injection.
Read →Listmonk newsletter and mailing list manager security testing: admin/listmonk documented default credentials in plaintext in config.toml; config.toml single-file plaintext exposure of admin password, PostgreSQL password, and SMTP credentials (host/username/password); GET /api/subscribers/export all subscriber emails, names, custom attributes PII as CSV; SMTP abuse using extracted credentials for spam/phishing from victim's trusted sending domain causing deliverability damage; PostgreSQL subscribers table all mailing list data including attribs JSONB custom profile fields; subscriber_lists table complete opt-in records; GDPR breach risk covering all mailing list members; campaign API for unauthorized bulk email sending.
Read →Vikunja task management platform security testing (Todoist alternative): VIKUNJA_SERVICE_JWTSECRET JWT token forgery as any user; open registration enabled by default enabling unauthorized account creation; GET /api/v1/tasks/all all tasks across all accessible projects with titles, descriptions, assignees, and deadlines — complete organizational work plan; GET /api/v1/users/list?s= all platform user emails for targeted phishing; PostgreSQL tasks table all organizational task history; projects table all team project details; config.yml VIKUNJA_SERVICE_JWTSECRET and database password; OIDC/LDAP configuration exposure for SSO credential extraction.
Read →Penpot design platform security testing (Figma alternative): admin@example.com/penpot documented demo credentials left unchanged; PENPOT_SECRET_KEY cookie signing key for session forgery; GET /api/export-binfile?file-id= complete binary design file download enabling IP theft; Redis KEYS penpot:session:* all active session tokens for hijacking; PostgreSQL file.data column binary design data for all team files; team member enumeration with emails; PENPOT_FLAGS misconfigurations (open registration, email verification bypass); SMTP credential extraction; design file project sharing boundary assessment; unreleased product mockup and brand asset exfiltration risk.
Read →Mailcow email server suite security testing (mailcow-dockerized): admin/moerigy documented default credentials; GET /api/v1/get/dkim/{domain} DKIM private RSA key extraction enabling DKIM-signed email spoofing for any hosted domain; mailcow.conf plaintext DBPASS/DBROOT/REDISPASS; MySQL dkim table all DKIM private keys in plaintext; MySQL api table API keys in plaintext; POST /api/v1/add/mailbox create mailboxes for IMAP/SMTP access; SOGo webmail direct email/calendar/contact access; all mailbox credentials (bcrypt) in MySQL mailbox table; SMTP relay abuse potential; complete organizational email infrastructure compromise.
Read →Plausible Analytics (Google Analytics alternative) security testing: SECRET_KEY_BASE Phoenix session signing key forgery; Stats API GET /api/v1/stats/breakdown all traffic intelligence — top pages, sources, UTM campaigns, conversion goals for all tracked sites; GET /api/v1/sites all tracked domains; ClickHouse HTTP interface events_v2 table all raw pageview events with visitor fingerprints (user_id hashes), URLs, referrers, UTM params; PostgreSQL goals table all conversion funnels; shared dashboard link enumeration for public stats bypass; open registration testing; Docker DISABLE_REGISTRATION and SECRET_KEY_BASE exposure; business intelligence exfiltration risk.
Read →Typebot (Typeform/chatbot builder alternative) security testing: NEXTAUTH_SECRET NextAuth JWT session token forgery for full admin access; API GET /api/typebots all chatbot flow configurations including embedded integration secrets (webhook URLs, Google Sheets keys, CRM credentials); GET /api/typebots/{id}/results/export all visitor form submissions as CSV with PII (names, emails, phones); PostgreSQL Answer table all individual visitor responses; S3/MinIO file upload bucket credential extraction; Docker NEXTAUTH_SECRET/DATABASE_URL exposure; lead generation pipeline data compromise; GDPR-regulated visitor PII bulk exfiltration.
Read →Planka (Trello alternative Kanban board) security testing: demo@demo.demo/demo documented default credentials never removed; SECRET_KEY JWT token signing key for full admin session forgery; GET /api/projects all boards and project structure; GET /api/boards/{id} all cards with descriptions containing meeting notes, decisions, links, and occasionally plaintext credentials; card_comment table all team discussion history; PostgreSQL complete card and comment content extraction; user email enumeration via GET /api/users for phishing targeting; Docker SECRET_KEY/DEFAULT_ADMIN_PASSWORD exposure; organizational intelligence and project roadmap exfiltration.
Read →Miniflux RSS feed reader security testing: admin/admin common default credentials; FEVER API MD5(username:password) hash authentication trivially brute-forced offline; API key GET /v1/feeds all RSS subscriptions revealing complete information monitoring landscape including private/internal feeds; GET /v1/entries all locally cached article content; PostgreSQL user_sessions active session token extraction for direct hijacking; users password hashes; entries complete read history; feeds all monitored URLs for competitive intelligence mapping; Docker DATABASE_URL plaintext exposure.
Read →Healthchecks cron job monitoring security testing (PagerDuty/Dead Man's Snitch alternative): PING token fake success check-in to suppress legitimate failure alerts for backups/security scans/compliance checks; SECRET_KEY Django session signing key forgery; API GET /api/v3/checks all monitored jobs with ping URLs and schedules; GET /api/v3/channels Slack webhooks/PagerDuty keys/Telegram tokens/OpsGenie keys; PostgreSQL api_channel value JSON all integration credentials; auth_user password hashes; Django admin superuser creation; alert suppression attack enabling failed backup masking.
Read →Memos note-taking platform security testing: first registered user auto-becomes admin — open registration allows instant admin takeover before legitimate admin registers; JWT token API GET /api/v1/memos all notes including private ones with admin token; GET /api/v1/resources all uploaded file attachments; SQLite memos.db direct access for all content regardless of visibility; system_setting table S3 storage credentials and SMTP email credentials; user enumeration for phishing targeting; Docker DSN database path exposure; private memo content (passwords, API keys, confidential notes) exfiltration risk.
Read →Wallabag read-it-later platform security testing (Pocket/Instapaper alternative): wallabag/wallabag documented default credentials; Symfony APP_SECRET/SYMFONY__ENV__SECRET session signing key forgery; OAuth2 client_id/client_secret from configuration enables API token generation without user password; GET /api/entries.json all saved articles with full cached HTML content including paywalled articles; user annotation and personal note extraction; PostgreSQL wallabag_oauth2_clients client_secret in plaintext; wallabag_entry table full article content; tag enumeration for reading profile analysis; Docker SYMFONY__ENV__SECRET exposure.
Read →Dashy self-hosted dashboard security testing: no authentication by default — all service URLs, API keys, and status check endpoints publicly accessible; conf.yml embeds API keys for ALL integrated services (Portainer, Grafana, Proxmox, Home Assistant, Nextcloud, GitHub PAT, weather API keys); statusCheck URL fields map complete internal network topology with all IP addresses and ports; widget options contain API tokens; statusCheckHeaders may embed Authorization headers; Docker volume conf.yml secret extraction; authentication bypass; localStorage session token analysis; infrastructure enumeration from single config file.
Read →Apache Guacamole remote desktop gateway security testing: guacadmin/guacadmin documented default credentials; MySQL guacamole_connection_parameter table all RDP passwords, SSH private keys, and VNC passwords stored in PLAINTEXT; GET /api/session/data/mysql/connections all server connection inventory; API /api/tokens auth token with default credentials enables full gateway access; guacd TCP 4822 daemon exposure for unauthenticated protocol commands; active session enumeration; lateral movement to every connected server via extracted credentials; Docker MySQL root password exposure; guacamole.properties JDBC credential extraction.
Read →Joplin Server note sync security testing: admin@localhost/admin documented default credentials; APP_SECRET signs session tokens enabling session forgery; sync API GET /api/items/root/delta enumerates all notes and attachments; api_clients table stores all user sync tokens in plaintext for full note library access; PostgreSQL items table all note content including notes marked private; shared note hash URL public access without authentication; Docker APP_SECRET/DB_PASSWORD plaintext exposure; complete note library exfiltration via sync protocol.
Read →HedgeDoc collaborative editor (CodiMD fork) security testing: CMD_SESSION_SECRET Express session signing key enables session forgery for any user; guest access enabled by default allowing unauthenticated note reading; PostgreSQL Notes table all collaborative documents regardless of permission; Users.profile JSON column stores GitHub/Google OAuth tokens for linked accounts; allowFreeURL custom note names enumerable by predictable patterns; Docker CMD_SESSION_SECRET/CMD_DB_URL plaintext exposure; complete team documentation library extraction.
Read →Shlink URL shortener security testing: API key is the sole authentication mechanism — GET /rest/v3/short-urls enumerates all shortened URLs with destination targets; short code brute-force without API key reveals destination URLs via redirect responses; database api_keys table stores all API keys in plaintext; visits table all click events with visitor IP addresses and geolocation; INITIAL_API_KEY Docker environment variable exposure; Shlink Web Client embedded API key in servers.json; complete marketing campaign and internal tool URL inventory exfiltration.
Read →Kasm Workspaces browser-based VDI security testing: admin@kasm.local/admin documented default credentials; API key pairs (api_key + api_key_secret) stored in plaintext in PostgreSQL users table control all workspace provisioning; GET /api/public/get_kasms active session token enumeration enables VNC session hijacking; agent API keys control underlying container hosts; workspace image run_config environment variables may embed secrets passed to user containers; PostgreSQL kasms table session tokens with direct container connection details.
Read →Owncast self-hosted live streaming security testing: admin/abc123 documented default credentials; RTMP stream key also defaults to abc123 — anyone with stream key can broadcast unauthorized video to all viewers; SQLite configuration table stores stream key in plaintext; admin API /api/admin/chat/messages full chat history with viewer IP addresses and geolocation; access_tokens table API credentials in plaintext; /api/admin/viewers real-time viewer tracking with IP data; owncast.db filesystem access reveals all credentials without admin login.
Read →Stalwart Mail (Rust JMAP/IMAP/SMTP) security testing: admin/secret documented default credentials; JWT signing secret enables OAuth2 token forgery for any email account without passwords; DKIM private key from config.toml enables sending email as any domain user with valid cryptographic signature; JMAP API Email/query + Email/get downloads all email from any mailbox with admin credentials; REST /api/principal enumerates all accounts; app passwords stored as hashes; management API /api/settings may expose JWT secret in plaintext.
Read →Hoppscotch API testing platform (open-source Postman alternative) security testing: JWT_SECRET enables session token forgery for any user; team environment variables accumulate API keys, OAuth secrets, database URLs, and bearer tokens used in testing — complete credential exfiltration from one breach; PostgreSQL TeamEnvironment table all shared API credentials in JSONB; PersonalAccessToken table plaintext tokens; admin API /v1/admin/users and /v1/admin/teams full workspace enumeration; OAuth2 client secrets (Google/GitHub) in Docker environment.
Read →Cachet status page security testing: APP_KEY Laravel session cookie forgery for admin access; X-Cachet-Token API key full incident and component management; /api/v1/components unauthenticated public API reveals internal infrastructure names and service topology; /api/v1/subscribers with API key exposes all customer subscriber email addresses; database cachet_users API keys stored in plaintext; CVE-2021-39172 Server-Side Template Injection RCE on unpatched Cachet 2.3.x/2.4.x; incident messages contain internal outage root cause details.
Read →Crater self-hosted invoicing security testing: admin@example.com/password common default credentials; APP_KEY Laravel session forgery; live Stripe and PayPal secret keys stored in database settings table — enables unauthorized charges and customer payment data access via payment gateway API; API Bearer token /api/v1/invoices and /api/v1/payments all client financial records; installation wizard /api/v1/app/install open on unconfigured deployments allows admin account creation without credentials; Docker APP_KEY/STRIPE_SECRET exposure.
Read →Zulip team messaging security testing: SECRET_KEY signs Django sessions enabling admin session forgery; every Zulip user and bot has a persistent API key stored in plaintext in zerver_userprofile — database breach gives working API keys for all users; GET /api/v1/messages all stream messages with any valid API key; PostgreSQL zerver_message stores all content including private messages and direct messages in plaintext; admin API /api/v1/users/{id}/api_key retrieves any user's API key; RabbitMQ/Redis/PostgreSQL credentials in zulip-secrets.conf.
Read →Standard Notes encrypted notes server security testing: SECRET_KEY_BASE Rails session signing key enables admin session forgery; JWT access tokens authenticate all API requests; while note content is E2E encrypted by the client, session token compromise enables account takeover, session revocation across all devices, and account manipulation; PostgreSQL sessions table stores all active bearer tokens; users table encrypted passwords and account metadata; open registration if DISABLE_USER_REGISTRATION not set allows unauthorized resource consumption.
Read →Kutt self-hosted URL shortener security testing: JWT_SECRET token forgery gives admin access to all platform links from all users; admin API /api/v2/links?all=true enumerates all shortened URLs with full destination targets; PostgreSQL users.api_key stored in plaintext — database breach exposes working API keys for all accounts; links.target column all redirect destinations in plaintext; visits table click analytics with country/city geolocation and referrer data; Docker JWT_SECRET/DB_PASSWORD/ADMIN_EMAILS/MAIL_PASSWORD credential exposure.
Read →Rallly self-hosted scheduling app security testing: NEXTAUTH_SECRET JWT session token forgery for any user account; PostgreSQL participants table all participant names and email addresses from every scheduling poll — PII breach affecting non-registered guest participants; poll adminUrlId secret token stored in database enables full poll management for any poll on the platform; Google/GitHub/Microsoft OAuth client_secret exposure; SMTP_PASSWORD email delivery credentials; tRPC API poll participant list unauthenticated access on public polls.
Read →Changedetection.io website monitoring security testing: no authentication by default — all monitored URLs and complete change history accessible unauthenticated; Apprise notification URLs store Slack tokens, Discord webhook URLs, Telegram bot tokens, and SMTP credentials embedded in plaintext; custom request headers containing Authorization Bearer tokens used to authenticate against monitored internal services; API key in /datastore/secret.txt plaintext; watch history snapshots store full page content; Docker USE_PASSWORD configures access protection.
Read →Tandoor Recipes self-hosted recipe management security testing: SECRET_KEY Django session cookie forgery enables admin impersonation; Django admin /admin/ panel with admin/admin default credentials provides full database access; API token /api/auth/login/ full recipe library, meal plan, and shopping list access; PostgreSQL knox_authtoken all active API tokens; auth_user all accounts with email addresses; meal_plan dietary preferences and daily eating patterns; SOCIALACCOUNT_PROVIDERS Google/GitHub OAuth client_secret Docker exposure.
Read →Duplicati backup software security testing: no webservice password by default — admin UI port 8200 unauthenticated; /api/v1/backup all backup job TargetURLs contain embedded destination credentials; S3 access keys, FTP passwords, SFTP credentials, Google Drive OAuth refresh tokens extracted directly from the API; SQLite Duplicati-server.sqlite Options table all destination credentials; source paths reveal /etc/, /home/.ssh/, database dump locations; webservice-password optional admin protection; Docker volume mounts expose backup source paths.
Read →Firefly III personal finance manager security testing: APP_KEY Laravel encryption key session forgery; Personal Access Token /api/v1/accounts all bank accounts with balances and IBAN numbers; /api/v1/transactions complete financial history with amounts and descriptions; PostgreSQL transaction_journals all financial records; oauth_access_tokens all non-revoked API tokens; accounts table account numbers and IBANs; Docker APP_KEY/DB_PASSWORD/MAIL_PASSWORD exposure; webhook configurations leaking transaction data to external endpoints.
Read →Linkwarden bookmark manager security testing: NEXTAUTH_SECRET JWT session forgery for any user account; PostgreSQL Link table all bookmarked URLs revealing research topics and browsing patterns; Archive table file paths to stored HTML snapshots, PDFs, and screenshots of bookmarked pages including authenticated sessions; /api/v1/links all bookmark URLs and descriptions; /api/v1/collections private collections with member email addresses; open registration if DISABLE_REGISTRATION not set; Docker NEXTAUTH_SECRET/DATABASE_URL/GOOGLE_CLIENT_SECRET exposure.
Read →YOURLS PHP URL shortener security testing: admin/admin default credentials; signature token API authentication bypass — md5(timestamp + secret_key) enables passwordless API access when secret_key is exposed from config.php; MySQL yourls_links all shortened URL destinations; yourls_log click events with visitor IP addresses and referrer URLs; yourls_options admin credentials hash; config.php YOURLS_DB_PASS and YOURLS_SECRET extraction; Docker YOURLS_USER/YOURLS_PASS/YOURLS_DB_PASS exposure; unauthenticated API stats access on misconfigured deployments.
Read →Grocy household ERP security testing: admin/admin default credentials; GROCY_AUTH_CLASS NoneAuthMiddleware disables authentication entirely for unauthenticated API access; API key Bearer token full household data access including grocery inventory, chore schedules, and shopping lists; SQLite users table plaintext API key storage; grocy.db products and stock locations revealing household contents; tasks table personal to-do list; Docker GROCY_AUTH_CLASS configuration assessment; meal plan dietary data extraction; api-keys.json plaintext key file exposure.
Read →Actual Budget personal finance security testing: single server password protects all budgets with no per-user isolation — one password grants access to every user's financial data; /sync/list-user-files enumerates all budget files; budget blob download gives complete SQLite database with full transaction history; unencrypted budget blobs store account names, balances, and complete transaction history; server-files directory contains all budget SQLite databases; Docker ACTUAL_SERVER_FILES path; config.json credential exposure; budget encryption status assessment.
Read →Navidrome music server security testing: admin/admin default credentials; Subsonic API plaintext password URL parameter (?p=PASSWORD) visible in nginx/Apache access logs and reverse proxy logs; /rest/getUsers admin-only user enumeration with email addresses; SQLite annotation table complete play history per user; ND_REVERSEPROXYUSERHEADER authentication bypass when direct access possible; Docker ND_DEFAULTADMINPASSWORD default credentials; ND_MUSICFOLDER music library path disclosure; /rest/getMusicFolders server filesystem path exposure.
Read →Radicale CalDAV/CardDAV server security testing: auth=none default configuration enables unauthenticated PROPFIND collection enumeration; htpasswd MD5-APR and SHA1 hash formats offline crackable with hashcat; REPORT addressbook-query extracts all vCard contacts with phone numbers, home addresses, and email addresses; REPORT calendar-query extracts all iCalendar events with meeting titles, attendees, and private descriptions; filesystem plaintext .vcf and .ics file access; per-user collection isolation bypass in multi-user deployments; HTTP Basic Auth over plain HTTP credential transmission.
Read →Shiori bookmark manager security testing: default shiori/shiori credentials (both username and password are "shiori"); JWT session token full bookmark history access; GET /api/v1/bookmarks complete browsing history with tags and private notes; public bookmark endpoint unauthenticated URL enumeration; offline archive sensitive page content access; SQLite bookmark table all URLs and argon2 password hashes; SHIORI_PG_PASS PostgreSQL credential exposure; no per-user bookmark isolation — any session can read any user's bookmarks.
Read →FileBrowser web file manager security testing: admin/admin default credentials; JWT token /api/resources/ file system enumeration and download; arbitrary file upload including PHP/Python web shells via POST /api/resources/; root path set to / exposes entire server filesystem; exec command API enables OS command execution if configured; database.db SQLite user table bcrypt hashes and share tokens; unauthenticated share link file access via non-expiring tokens; Docker bind mount scope analysis for root path boundaries.
Read →Gogs Git server security testing: open registration exploitation for self-registration and admin account creation on first-user; /install endpoint re-setup attack for full takeover; API token generation via /api/v1/users/{user}/tokens with admin/admin credentials; GET /api/v1/repos/search all repository enumeration including private repos; app.ini plaintext database PASSWD and SMTP password extraction; SQLite access_token table SHA1 hashes; webhook secret plaintext storage; git clone with token for full source code and secrets extraction.
Read →ToolJet low-code platform security testing: admin credential compromise gives access to all connected system credentials (production databases, AWS IAM keys, Stripe API keys, Twilio tokens); GET /api/v2/data_sources all data source options including plaintext fields; LOCKBOX_MASTER_KEY Docker environment variable decrypts all encrypted data source credentials; PostgreSQL data_sources table credential JSON extraction; app_environments_variables plaintext secret storage; SECRET_KEY_BASE session token forgery; blast radius extends to every system ToolJet connects to.
Read →Etherpad collaborative editor security testing: APIKEY.txt web exposure gives full API access to all pads without authentication; GET /api/1/listAllPads enumerates every pad ID on the server; GET /api/1/getText extracts complete pad content; admin/changeme common default admin panel credentials; DirtyDB dirty.db stores all pad text and complete revision history including deleted content in plaintext; settings.json contains dbSettings.password and admin user credentials; Docker ADMIN_PASSWORD and DB_PASSWORD environment variable exposure.
Read →Mastodon social media server security testing: SECRET_KEY_BASE from .env.production enables arbitrary session token forgery for any account including admins; OTP_SECRET enables computing TOTP codes bypassing two-factor authentication for all users; Sidekiq web UI /sidekiq commonly accessible without authentication revealing job data; PostgreSQL statuses table stores all direct messages unencrypted; oauth_access_tokens table contains all active API tokens; AWS_SECRET_ACCESS_KEY media bucket full access; VAPID_PRIVATE_KEY push notification signing key exposure.
Read →Jitsi Meet video conferencing security testing: JWT_APP_SECRET enables forging moderator tokens with room=* access to all meeting rooms; ENABLE_AUTH=0 default allows anonymous join and room creation without authentication; Jicofo REST API on port 8888 exposes active conference statistics without authentication; predictable meeting room names enumerable without credentials; Prosody component_secret weak defaults enable XMPP component impersonation; .env JWT_APP_SECRET, JVB_AUTH_PASSWORD, JICOFO_COMPONENT_SECRET, and TURN shared secret extraction.
Read →Lemmy federated link aggregator security testing: jwt_secret from lemmy.hjson enables forging HS256 JWT tokens for any user including admins; GET /api/v3/person/list enumerates all users without authentication; GET /api/v3/site reveals all admin account IDs; PostgreSQL private_message table stores all DMs unencrypted; local_user table contains bcrypt password hashes, email addresses, and totp_2fa_secret enabling 2FA bypass; ActivityPub /u/{username} user existence checking; lemmy.hjson database URI and SMTP password extraction.
Read →PeerTube video platform security testing: admin@example.com/peertube common default admin credentials; secrets.peertube JWT signing key extraction enables session token forgery; GET /api/v1/users lists all users and emails with admin token; PostgreSQL video table reveals private and internal video metadata; user_video_history viewing data extraction; object_storage S3 credentials in production.yaml for video file access; OAuth access token enumeration; ActivityPub user enumeration without authentication; SMTP password and Redis connection string exposure.
Read →code-server VS Code browser security testing: config.yaml plaintext password storage enables direct credential extraction; auth: none configuration provides unauthenticated full VS Code access; /login endpoint has no rate limiting enabling password brute-force; integrated terminal provides immediate RCE as service account; post-auth credential harvest includes SSH private keys (~/.ssh/id_rsa), AWS credentials (~/.aws/credentials), .kube/config, and cloud credential environment variables; port forwarding proxy exposes internal services on development machine to internet.
Read →Pixelfed photo sharing platform security testing: APP_KEY from .env enables Laravel session cookie AES-256-CBC forgery for any user including admins; admin@pixelfed.test/password documented default admin credential in many deployments; PostgreSQL users table bcrypt password hash and email extraction; private photo S3 media bucket access via AWS_SECRET_ACCESS_KEY; oauth_access_tokens persistent API access enumeration; ActivityPub /users/{username} unauthenticated user enumeration; MAIL_PASSWORD SMTP credential exposure from .env.
Read →Matrix Synapse homeserver security testing: registration_shared_secret enables creating admin accounts via /_synapse/admin/v1/register without any existing credentials using HMAC-SHA1 MAC; admin API /_synapse/admin/v2/users enumerates all users and rooms; PostgreSQL access_tokens table contains active session tokens usable directly as Bearer tokens; non-E2EE room messages stored in plaintext in events.content column; homeserver.signing.key ed25519 private key enables federation impersonation; macaroon_secret_key access token forgery.
Read →Excalidraw collaborative whiteboard security testing: guessable room IDs enable joining active collaboration sessions without authentication; excalidraw-room server Redis unauthenticated access exposes all active room drawing data; Firebase storage bucket permission misconfiguration allows unauthenticated diagram download; Firebase API key extraction from client-side JavaScript bundle; CORS wildcard on excalidraw-room server enables cross-origin room access; .env VITE_APP_FIREBASE_CONFIG and REDIS_URL credential exposure; Redis KEYS * enumerates all active rooms.
Read →CryptPad zero-knowledge office security testing: adminKeys in config.js controls admin panel access — if misconfigured or left as example key, admin access is uncontrolled; MongoDB session collection contains active authentication tokens for all users; open registration (restrictRegistration: false) revealed via /api/config allows unauthorized account creation; mongoUri credential extraction from config.js; blob storage encrypted files accessible by hash; CPAD_ Docker environment variable exposure; /checkup diagnostic endpoint; server-side metadata not encrypted despite zero-knowledge claims.
Read →Funkwhale federated music streaming security testing: DJANGO_SECRET_KEY in .env enables Django session cookie forgery for any user account; admin credentials set during setup often use admin/funkwhale or admin/password; PostgreSQL auth_user table stores all PBKDF2 password hashes and emails; listening history in history_listening table reveals user activity; S3 AWS_SECRET_ACCESS_KEY grants access to entire music library; ActivityPub /federation/actors/{username} enables user enumeration without authentication; OAuth2 token enumeration via /api/v1/oauth/apps/; EMAIL_HOST_PASSWORD SMTP credential exposure.
Read →draw.io self-hosted diagramming security testing: export server /export3 endpoint processes SVG with external URL fetching enabling SSRF against internal services including AWS metadata endpoint 169.254.169.254; drawio-config.json may expose OAuth client secrets for Google Drive, OneDrive, GitHub, and Dropbox integrations; PlantUML server integration creates SSRF via !include directive; diagram XML files contain highly sensitive network topology, security architecture, and infrastructure data; version disclosure enables CVE targeting; Docker DRAWIO_ environment variable exposure.
Read →ownCloud file sharing security testing: config/config.php exposes dbpassword for full database access and passwordsalt enabling cracking all oc_users password hashes simultaneously; CVE-2023-49103 (CVSS 10.0) GraphAPI app exposes phpinfo including all environment variables and admin credentials; WebDAV /remote.php/dav/ allows brute-force with common admin/owncloud credentials; public share token enumeration via OCS API; owncloud.log error disclosure; ownCloud Infinite Scale OCIS_JWT_SECRET service token forgery; /status.php version disclosure for CVE targeting.
Read →XWiki enterprise wiki security testing: Admin/admin default credentials common across enterprises give full administrative access; Groovy-based wiki macros enable server-side Java code execution through the wiki editor without any file upload; CVE-2024-31982 allows unauthenticated database queries via the search endpoint exposing all wiki data; CVE-2023-26470 SSTI RCE in group member field without scripting rights; /WEB-INF/xwiki.cfg exposes JDBC database password, LDAP bind credentials, and SMTP passwords; XAR package import executes server-side code during import.
Read →Pterodactyl game server panel security testing: APP_KEY in .env enables Laravel session cookie forgery to authenticate as any user including administrators without knowing credentials; admin application API key (ptla_) enumerates all users, servers, and configurations via /api/application/; Wings daemon /etc/pterodactyl/config.yml node token enables direct server file access; MySQL DB_PASSWORD reveals api_keys table with all application and client tokens; SFTP access (port 2022) exposes game server configs including RCON passwords, Discord bot tokens, and plugin database credentials.
Read →Sentry self-hosted error tracking security testing: SENTRY_SECRET_KEY in sentry.conf.py enables Django session cookie forgery for any user; error events in PostgreSQL contain stack traces with hardcoded credentials, environment variables with API keys, and Authorization request headers capturing live tokens; project DSN keys allow arbitrary event submission; sentry_apitoken table exposes all permanent API tokens; /api/0/organizations/ enumerates all organizations; source map files uploaded for error de-obfuscation expose original unminified JavaScript source code with business logic.
Read →Rundeck job scheduler security testing: admin/admin default credentials grant full access to all automation jobs; job definitions exported as YAML contain hardcoded database passwords, API keys, and AWS credentials in script arguments; key storage vault (/api/40/storage/keys/) holds SSH private keys and passwords used by jobs; MySQL rundeck_auth_token table exposes all API tokens; rundeck-config.properties dataSource.password grants full database access; execution history reveals job option values including passwords passed as unmasked arguments; /api/40/system/info version disclosure without authentication.
Read →JupyterHub multi-user notebook security testing: CONFIGPROXY_AUTH_TOKEN grants full HTTP proxy admin access enabling user session enumeration and traffic redirection; admin API tokens can create user tokens via /hub/api/users/{user}/tokens enabling arbitrary Python code execution on any user's server; notebook .ipynb files contain hardcoded AWS_ACCESS_KEY_ID, GCP service account keys, and database passwords; jupyterhub_config.py exposes OAuth client secrets; /hub/api/authorizations/token/ enables token enumeration without rate limiting; hub.sqlite stores all active user sessions and tokens.
Read →osTicket helpdesk security testing: include/ost-config.php DBPASS MySQL database credentials expose all ticket data; setup/ directory accessible after installation allows admin password reset without credentials; REST API key stored in plaintext in ost_api_keys MySQL table grants full ticket CRUD access; staff credentials at /scp/ frequently use admin/admin or admin/osticket; ost_staff password hashes historically MD5-based; customer PII in ost_ticket and ost_user tables; email IMAP/SMTP credentials in ost_email table for all configured inboxes; attachment uploads in /upload/ directory may be web-accessible without authentication.
Read →Vtiger CRM security testing: config.inc.php db_password MySQL credentials expose all customer contacts, sales opportunities, and business accounts; vtiger_users accesskey column stores REST API access keys in plaintext enabling full CRM API access without knowing user passwords; admin/admin or admin@company.com default credentials at /index.php grant full CRM admin access; REST API /webservice.php?operation=getchallenge enables username enumeration; vtiger_users user_password stored as MD5 hashes; vtiger_mailscanner_status stores IMAP/SMTP email integration passwords; /storage/ document directory may be web-accessible; vtiger_potential sales pipeline and revenue data fully extractable.
Read →Apache Tomcat security testing: /manager/ application default credentials tomcat/tomcat or admin/admin allow WAR file deployment — direct path to Java code execution on the server; /manager/text/deploy API enables WAR upload without browser using curl; CVE-2020-1938 Ghostcat AJP port 8009 allows unauthenticated file read of any file in the webapp root including application.properties with database credentials; tomcat-users.xml stores all Manager and Host Manager credentials in plaintext; server.xml Resource elements expose JDBC DataSource database connection pool passwords; catalina.out logs application errors that may include credential disclosure; /examples/ application contains XSS demonstrations still functional in production.
Read →EspoCRM security testing: data/config.php database.password MySQL credentials plus passwordSalt that accelerates cracking all espo_user SHA-512 password hashes; cryptKey in config.php decrypts all encrypted field values including email integration passwords; admin/admin default credentials at /api/v1/App/user with Basic auth grant full CRM access; API users with api_key and secret_key in espo_user type='api' enable HMAC-authenticated API access without knowing user passwords; espo_contact customer PII enumeration; espo_email_account IMAP/SMTP credential extraction; espo_integration OAuth2 client secrets for Google/Outlook/Salesforce; data/ directory must be protected from web access.
Read →Cockpit CMS security testing: unauthenticated /api/cockpit/accounts endpoint in pre-0.11.2 versions returns all user records including API keys and password hashes; config/config.php exposes MongoDB connection string or SQLite database path; admin/admin default credentials; REST API keys transmitted as cleartext ?token= query parameters appearing in web server access logs; GraphQL /api/gql endpoint may allow unauthenticated content queries and schema introspection; storage/ directory web-accessible PHP webshell upload path; privilege escalation via /api/cockpit/saveUser role modification; SQLite db.sqlite direct file access containing all user API keys.
Read →OneDev Git and CI/CD security testing: database.properties hibernate.connection.password H2/MySQL database credentials; H2 db.mv.db file direct access contains all users, bcrypt hashes, access tokens, and build history; root account password shown once at startup and frequently stored in deployment scripts or Docker logs; AccessToken table contains all user API tokens enabling full repository clone and build trigger; .onedev-buildspec.yml build job YAML files contain hardcoded AWS keys, Docker registry passwords, SSH private keys; job secret API extraction; agent registration token file enables registering malicious build agents; /~api/server-information unauthenticated version disclosure.
Read →Shopware e-commerce security testing: .env APP_SECRET enables JWT token forgery and DATABASE_URL provides full MySQL access; admin/shopware or admin/admin default credentials at /api/oauth/token; integration secret_access_key values in the integration table enable Admin API access; payment plugin live keys (Stripe sk_live_, PayPal client_secret, Mollie live_) stored in plugin.config_values and system_config table; customer PII and order history via Admin API /api/customer and /api/order; .env.local and .env.prod may contain production credential overrides; sales channel OAuth2 client credentials in the database enable Storefront API authentication.
Read →PrestaShop security testing: config/settings.inc.php _DB_PASSWD_ MySQL credentials and _COOKIE_KEY_ session cookie key; install/ directory post-installation accessibility allows database reset and admin account takeover; ps_webservice table Webservice API keys stored in plaintext enable full /api/ access; CVE-2023-30839 SQL injection in product attribute operations (versions prior to 8.0.4); ps_employee MD5 password hashes and ps_customer PII extraction; payment gateway live keys in ps_configuration (Stripe, PayPal, Mollie); admin directory discovery via common renamed paths (/admin123/, /ps_admin/); /api/ unauthenticated Webservice access check.
Read →GitBucket security testing: root/root default credentials at /signin grant full site admin access; H2 DATABASE.mv.db file direct access contains all users, password hashes, personal access tokens, SSH keys, and repository metadata; gitbucket.conf db.password PostgreSQL/MySQL credentials and oidc.client_secret; GitHub-compatible /api/v3/ REST API personal access tokens never expire by default; admin /api/v3/admin/users and /api/v3/admin/repos enumeration; repository content scanning via API for committed .env files, database credentials, and AWS keys; deploy key SSH public key extraction; webhook secret enumeration; H2 web console port 8082 unauthenticated exposure.
Read →Magento security testing: app/etc/env.php MySQL database password and crypt key that decrypts all sensitive values in core_config_data including payment gateway API keys (Stripe, PayPal, Authorize.net); admin/admin123 default credentials at custom admin path; /magento_version unauthenticated version disclosure for CVE targeting; CVE-2022-24086 unauthenticated RCE via order placement form template injection; REST API OAuth integration access tokens from oauth_token table; admin_user bcrypt hashes and customer_entity PII; payment provider credentials in core_config_data decryptable with extracted crypt key.
Read →Joomla CMS security testing: configuration.php MySQL password and $secret key for session HMAC signing; CVE-2023-23752 unauthenticated REST API database credential disclosure (Joomla 4.0.0-4.2.7) via /api/index.php/v1/config/application?public=true exposing host/user/password/SMTP credentials; admin/admin default credentials at /administrator/; Joomla 4+ REST API Bearer token enumeration of users and content; jos_users bcrypt and MD5:salt password hashes; Super User group extraction; API token extraction from jos_user_keys; version disclosure via manifests/files/joomla.xml for CVE targeting.
Read →Drupal CMS security testing: sites/default/settings.php MySQL credentials and hash_salt enabling one-time login URL generation for any user; CVE-2018-7600 Drupalgeddon2 unauthenticated RCE via Form API AJAX on Drupal 7.x < 7.58 and 8.x < 8.5.1; admin/admin credentials at /user/login; JSON:API /jsonapi/ unauthenticated content enumeration; update.php and install.php HTTP accessibility; users_field_data SHA-512 and bcrypt password hash extraction; config sync directory YAML API key scanning; private files directory web-accessible content; REST API /rest/session/token CSRF token assessment; CHANGELOG.txt version disclosure.
Read →Pimcore PIM/CMS/DXP security testing: .env DATABASE_URL MySQL credentials and APP_SECRET Symfony secret enabling session cookie forgery; admin/admin and admin/pimcore default credentials at /admin/login/check; REST API user API keys stored in plaintext in users.apiKey column; GraphQL API /pimcore-graphql-webservices/ schema introspection and data object enumeration; data object customer and product PII extraction via /webservice/rest/object-list; asset manager PHP webshell upload assessment; Symfony APP_DEBUG=true debug toolbar credential disclosure; data object class definition export; users table SHA-512 and bcrypt password hash extraction.
Read →WHMCS billing platform security testing: configuration.php MySQL db_password and cc_encryption_hash AES key for credit card decryption; admin/admin credentials at /admin/ (customizable path); tblpaymentgateways Stripe sk_live_, PayPal, and Braintree live API key extraction; tblclientcard credit card AES decryption with cc_encryption_hash; tblclients client PII including names, emails, addresses, and hosting account data; tblapi_credentials API identifier and secret extraction; tbladmins MD5 and bcrypt password hashes; tblorders financial and order history; WHMCS version disclosure for CVE targeting; IP restriction bypass assessment for /admin/ access.
Read →Moodle LMS security testing: config.php MySQL dbpass credentials and moodledata directory path; admin/admin credentials at /login/index.php; REST API web service token generation via /login/token.php (moodle_mobile_app service); mdl_external_tokens persistent API token extraction (validuntil=0 never expire); mdl_user SHA-512 password hashes with passwordsaltmain salt; passwordsaltmain extraction from mdl_config; student PII and academic grade data via core_user_get_users and mdl_grade_grades; quiz attempt and submission content via mdl_quiz_attempts; file upload PHP webshell in moodledata directory; Moodle version disclosure via /webservice/rest/server.php site info.
Read →MediaWiki wiki security testing: LocalSettings.php MySQL wgDBpassword and wgSecretKey session token signing secret; Admin/admin default credentials at Special:UserLogin; Action API /api.php unauthenticated list=allusers user enumeration with augroup=sysop admin identification; user table PBKDF2:sha512 and legacy MD5 password hash extraction; bot_passwords persistent API token extraction; Special:Export unauthenticated bulk page content export; file upload PHP extension bypass (.php5, .phtml, .phar) assessment; mw-config/ upgrade interface accessibility; wgUploadPath PHP execution protection verification; MediaWiki version disclosure via siteinfo API.
Read →phpBB forum security testing: config.php MySQL dbpasswd and table_prefix credentials; admin/admin credentials at /adm/ ACP Administration Control Panel; /install/ directory post-installation accessibility enabling database re-initialization; phpbb_users bcrypt and legacy MD5 password hash extraction; phpbb_sessions active admin session_id token hijacking (32-char MD5 cookie); phpbb_privmsgs private message content enumeration; ADMINISTRATORS group membership identification; ACP PHP template code execution assessment; file attachment PHP extension bypass; phpBB version disclosure for SQL injection CVE targeting.
Read →Concrete CMS (formerly Concrete5) security testing: application/config/database.php MySQL password credentials; admin/admin and admin/concrete default credentials at /index.php/login; /ccm/system/upgrade/ upgrade interface unauthenticated accessibility; OauthClients plaintext client_secret extraction; Users table bcrypt password hashes; Administrators group membership; file manager PHP extension upload webshell (.php, .php5, .phtml); version disclosure via /concrete/version.txt for CVE targeting; application/config/ directory web access assessment; REST API OAuth Bearer token enumeration; /index.php/api/v1/system/info unauthenticated version disclosure.
Read →HumHub enterprise social network security testing: protected/config/common.php MySQL db/dsn credentials; admin/admin default credentials at /user/auth/login; REST API v1 Bearer token authentication; user table SHA-512 password hashes; space and post content enumeration; LDAP integration credential exposure in admin settings; file upload PHP extension bypass in user content; API token extraction from user_auth_token table; group membership and space permission enumeration; /protected/runtime/ log file information disclosure.
Read →BigBlueButton security testing: /etc/bigbluebutton/bbb-web.properties securitySalt shared secret for API authentication via HMAC-SHA1 checksum; unauthenticated /bigbluebutton/api/ endpoint enumeration; recordings URL pattern brute-force giving unauthenticated access to all meeting recordings; FreeSWITCH /etc/freeswitch/ SIP credentials and event_socket_conf.xml password; Redis database meeting session data; Greenlight admin credentials; bbb-conf --secret admin API secret extraction.
Read →MyBB forum security testing: inc/config.php MySQL database password and table prefix; admin/admin default credentials at /admin/ ACP Administration Control Panel; /install/ directory post-installation accessibility enabling database re-initialization; mybb_users double MD5+salt password hash extraction; Administrator group (usergroup=4) identification; mybb_sessions active admin session_id token hijacking for cookie injection; mybb_privatemessages private message content enumeration; mybb_adminlog recent admin action review; MyBB version disclosure for SQL injection CVE targeting; /inc/ directory PHP file web access protection verification.
Read →Chamilo LMS security testing: app/config/configuration.php MySQL db_password credentials; admin/admin default at /main/auth/login.php; REST API web service key (ws_api_key) extraction from user table; user table SHA-512 salted password hashes; student PII from extra_field_values; course grade data from gradebook_result; c_student_publication file submission access; SOAP and REST web service API key authentication bypass; /main/admin/ restricted admin panel; Chamilo version disclosure for CVE targeting.
Read →SilverStripe CMS security testing: .env SS_DATABASE_PASSWORD and SS_DEFAULT_ADMIN_PASSWORD plaintext credential exposure; SS_SECRET_KEY session signing secret; /.env web exposure test (HTTP 200 = full credential dump); /dev/build unauthenticated database schema rebuild in development mode; Member table bcrypt and legacy MD5 password hashes; Group_Members administrators identification; AccessToken plaintext Bearer token enumeration; GraphQL /graphql introspection and unauthenticated data access; SilverStripe version disclosure for CVE targeting.
Read →Vanilla Forums security testing: conf/config.php MySQL database password and Garden.Cookie.Salt session signing key; admin/admin default credentials at /entry/signin; REST API v2 Personal Access Token (PAT) Bearer authentication; GDN_User bcrypt and legacy password hash extraction; GDN_User Admin=1 administrator identification; GDN_AccessToken plaintext PAT Bearer token enumeration (no-expiry tokens); REST API /api/v2/users unauthenticated email enumeration; GDN_ConversationMessage private message content access; Vanilla version disclosure for CVE targeting.
Read →XenForo forum security testing: src/config.php MySQL db/password credential extraction; admin credential brute-force at /admin.php ACP; xf_api_key super user REST API key extraction (full admin API access); xf_user bcrypt password hash extraction; xf_session active admin session_id token hijacking; xf_conversation_message private message enumeration; REST API /api/users admin status identification; /install/ directory post-installation exposure; XenForo version disclosure for CVE and add-on vulnerability targeting.
Read →ILIAS LMS security testing: ilias.ini.php and client.ini.php MySQL host/dbname/user/pass credential extraction; admin/homer notorious well-known default password at /ilias.php; il_oauth_access_token OAuth2 Bearer token extraction; usr_data MD5 (instantly crackable) and bcrypt password hash extraction; student PII from usr_data (firstname, lastname, email, institution); ut_lp_marks course completion and grade percentage extraction; /setup/ directory post-installation exposure; ILIAS debug mode configuration leak; version disclosure for CVE targeting.
Read →Tuleap ALM security testing: /etc/tuleap/conf/database.inc MySQL dbpasswd credential extraction; /etc/tuleap/conf/local.inc LDAP bind password and application key; admin/siteadmin credential brute-force; user table bcrypt hash extraction with site admin (admin='S') identification; user_access_key REST API personal access key token hash extraction; REST API project and tracker artifact enumeration; SVN and Git repository access control assessment; tracker artifact content access for sensitive project data; Tuleap version disclosure for CVE targeting.
Read →Open edX MOOC platform security testing: lms.env.json Django SECRET_KEY session cookie forgery enabling impersonation of any user including superusers; lms.auth.json MySQL, MongoDB, and Redis credential extraction; admin/edx default credentials at /admin/; oauth2_provider_application plaintext OAuth2 client_secret extraction; auth_user PBKDF2-SHA256 password hash extraction with superuser identification; auth_userprofile student PII (full name, gender, country, education level) access; grades_persistentcoursegrade course completion percentage extraction; MongoDB unauthenticated access on port 27017; Redis session data extraction on port 6379; Open edX version disclosure for CVE targeting.
Read →osCommerce legacy e-commerce security testing: catalog/includes/configure.php MySQL DB_SERVER_PASSWORD credential extraction; admin/admin brute-force at /admin/login.php with no account lockout protection; /install/ directory post-installation accessibility enabling admin password reset without knowledge of current credentials; customers table unsalted MD5 password hash extraction crackable in milliseconds; administrators table MD5 admin hash extraction; orders table customer PII (name, address, phone, email) and payment method enumeration; admin/file_manager.php PHP file upload RCE capability; admin/backup.php full database download; osCommerce version disclosure for SQL injection CVE targeting including historical SQLi vulnerabilities in products_id parameter.
Read →OpenMRS electronic medical records security testing: admin/Admin123 and daemon/daemon default credential testing at /openmrs/ws/rest/v1/session REST API; openmrs-runtime.properties MySQL connection.password extraction from ~/.OpenMRS/ and Tomcat home directories; REST API /openmrs/ws/rest/v1/patient unauthenticated or weak-auth patient PHI enumeration (names, birthdates, gender); obs table medical observation (lab results, diagnoses, vitals) access for all patients; person_name and patient_identifier patient PHI extraction with national ID numbers; users table SHA-512+salt password hash extraction; person_attribute contact information enumeration; encounter table visit and clinical record access; OpenMRS version disclosure for CVE targeting across HIPAA and GDPR-regulated healthcare environments.
Read →Zen Cart legacy e-commerce security testing: /zc_install/ directory post-installation accessibility enabling unauthenticated admin account creation and password reset; includes/configure.php MySQL DB_SERVER_PASSWORD credential extraction; admin/admin brute-force at /admin/index.php with no account lockout in older versions; zen_admin table MD5 unsalted admin hash extraction crackable in milliseconds; zen_customers table MD5 customer hash and PII (email, phone, name) extraction; zen_orders table purchase history and billing address enumeration; file_manager.php PHP file upload RCE assessment; backup.php full database download; exposed /extras/ and /docs/ directory enumeration; Zen Cart version disclosure for SQL injection CVE targeting.
Read →October CMS Laravel-based CMS security testing: .env APP_KEY Laravel session cookie forgery enabling impersonation of any authenticated user including superusers without password knowledge; .env DB_PASSWORD MySQL credential extraction; Laravel APP_DEBUG=true debug mode .env contents leakage (APP_KEY, DB_PASSWORD, all secrets) via triggered error pages; admin/admin brute-force at /backend/backend/auth/signin; backend_users table bcrypt hash extraction with is_superuser=1 administrator identification; rainlab_user_users frontend user hash extraction if RainLab.User plugin installed; system_settings table credential value enumeration; storage/logs/laravel.log web accessibility credential leakage assessment; October CMS version disclosure for CVE targeting.
Read →Craft CMS security testing: .env SECURITY_KEY HMAC token forgery enabling signed cookie and password reset link tampering; .env DB_PASSWORD MySQL credential extraction; devMode=true error page .env contents leakage including SECURITY_KEY and database credentials; GraphQL API /api schema introspection and unauthenticated content access assessment; admin credential brute-force at /admin/login; craft_users bcrypt hash extraction with admin=1 administrator identification; craft_gql_tokens plaintext GraphQL API token extraction; craft_recoverycodes password reset token enumeration; craft_social_useraccounts OAuth access token exposure if Social plugin installed; Craft CMS version disclosure for CVE targeting.
Read →ProcessWire PHP CMS/CMF security testing: site/config.php MySQL dbPass and userAuthSalt global salt extraction enabling batch cracking of all users table double-SHA-1 password hashes; admin credential brute-force at /processwire/ admin panel; users table double-SHA-1+userAuthSalt hash extraction with superuser role identification via users_roles mapping; REST Helper module unauthenticated page content access assessment; pages table hidden and unpublished draft content enumeration; site/assets/files/ sensitive document access without authentication; ProcessWire module inventory for unpatched CVE detection; ProcessWire version disclosure for security advisory targeting.
Read →Umbraco .NET CMS security testing: web.config connectionStrings SQL Server credential extraction (Data Source, User Id, Password); appsettings.json umbracoDbDSN Umbraco 9+ connection string extraction; admin credential brute-force at /umbraco/backoffice/UmbracoApi/Authentication/PostLogin; umbracoUser HMAC-SHA1 (Umbraco 7) and bcrypt hash extraction with userType=1 administrator identification; umbracoUserLogin session token enumeration enabling session replay; UFormRecords Umbraco Forms PII submission data access; media library /media/ file access without authentication; Umbraco version disclosure via /umbraco/api/keepalive/ping for CVE targeting.
Read →Kirby CMS flat-file security testing: site/accounts/ YAML files bcrypt password hash extraction for all panel users — web accessibility returns HTTP 200 on misconfigured servers allowing direct hash download without server access; site/sessions/ PHP session token enumeration enabling panel session replay without password; site/content/_drafts/ unpublished page content access in plaintext; site/config/config.php API key and SMTP credential extraction; REST API /api/auth/login admin credential brute-force; /api/system Kirby version disclosure for CVE targeting; Kirby plugin inventory for unpatched vulnerability detection; web server .htaccess and Nginx deny rule verification for all site/ subdirectories.
Read →TYPO3 enterprise PHP CMS security testing: typo3conf/LocalConfiguration.php MySQL DB[password] and encryptionKey extraction; ENABLE_INSTALL_TOOL file presence check enabling Install Tool admin password reset at /typo3/install/ without existing admin credentials; Install Tool default joh316 password testing; be_users table MD5 (TYPO3 <6.2), SHA-256+salt (6.2-8.x), or bcrypt (9+) admin password hash extraction with admin=1 superadmin identification; fe_users frontend user PII and credential enumeration; Extension Manager extension upload PHP code execution; /typo3conf/ web accessibility verification; TYPO3 version disclosure for CVE targeting.
Read →Grav CMS flat-file PHP security testing: user/accounts/ YAML files bcrypt password hash extraction — HTTP 200 on misconfigured servers allows direct hash download without server access; CVE-2023-34253 Twig SSTI in admin flex-objects enabling RCE (Grav <1.7.42); admin credential brute-force at /admin/login; user/config/security.yaml CSRF token signing key extraction; user/data/ form submission PII YAML files (contact forms, newsletter signups) in plaintext; logs/grav.log credential leakage assessment; Grav plugin inventory for unpatched CVE detection; /user/ /vendor/ /system/ /cache/ web accessibility verification.
Read →MODx Revolution PHP CMS security testing: core/config/config.inc.php MySQL database_password extraction — full database access to modx_users hashes and modx_session active tokens; /setup/ reinstallation directory accessibility enabling admin credential reset without existing credentials; modx_users SHA-512+salt admin password hash extraction with sudo=1 superadmin identification; modx_session active PHP session ID enumeration enabling session replay without password; modx_user_attributes email and PII extraction; modx_system_settings API key and SMTP credential enumeration; Extra/Package Manager PHP code execution; /core/ web accessibility verification; MODx version disclosure for CVE targeting.
Read →Pagekit PHP CMS (Vue.js + Symfony) security testing: config/app.php MySQL password and app secret key extraction — app secret enables JWT token forgery without any admin credentials; admin/admin default credential brute-force at /api/user/login JWT endpoint; pk_user table bcrypt hash extraction with Administrator role identification via pk_user_role; Extension Manager .zip upload PHP code execution via authenticated admin; pk_post draft and private post content enumeration; pk_option API key and integration secret extraction; /config/ web accessibility verification; Pagekit version disclosure for CVE targeting.
Read →Textpattern PHP CMS security testing: textpattern/config.php MySQL $db_pass extraction; admin/admin credential brute-force at /textpattern/index.php; txp_users MD5 (older) or Blowfish (4.6+) password hash extraction with privs=1 Publisher superadmin identification — MD5 hashes crack in milliseconds; plugin installation Base64-encoded PHP code execution via Publisher auth; txp_prefs SMTP password plaintext extraction; txp_file public uploaded document enumeration for sensitive file exposure; txp_article hidden and draft content access; textpattern/config.php web accessibility verification; Textpattern version disclosure for CVE targeting.
Read →ExpressionEngine commercial PHP CMS security testing: system/user/config/config.php MySQL db_password, encryption_key, and session_crypt_key extraction; admin credential brute-force at /admin.php; exp_members SHA-256+salt (EE <5) or bcrypt hash extraction with role_id=1 SuperAdmin identification — SHA-256 hashes vulnerable to GPU cracking; exp_sessions active session ID enumeration enabling admin panel replay without password; exp_channel_entries draft and embargoed content access; exp_email_cache form submission PII; Add-on Manager PHP module RCE; PHP template execution via SuperAdmin; /system/ web accessibility verification.
Read →Statamic Laravel CMS security testing: .env APP_KEY web accessibility enabling Laravel session cookie forgery — forge admin session without any credentials; users/admin.yaml YAML bcrypt hash and super:true flag web accessibility in flat-file mode; Statamic REST API unauthenticated content enumeration at /api/collections and user data at /api/users when STATAMIC_API_ENABLED=true without auth config; admin credential brute-force at /cp/auth/login; personal_access_tokens API bearer token extraction from MySQL; database users table bcrypt hash with super=1 identification; addon installer PHP code execution RCE assessment.
Read →Bolt CMS PHP (Symfony) security testing: app/config/config.yml MySQL database.password and APP_SECRET session forgery key extraction; admin/admin credential brute-force at /bolt/login; bolt_users bcrypt hash extraction with ROLE_ADMIN identification via JSON roles column; File Manager arbitrary file upload in /files/ directory — PHP execution enables web shell RCE if directory not protected; bolt_authtoken remember-me session token extraction for persistent session replay; bolt_content draft and held entry enumeration; /app/config/ and .env web accessibility verification; Bolt CMS version disclosure for CVE targeting.
Read →Contao PHP CMS security testing (popular in DACH region): system/config/localconfig.php MySQL $dbPass and encryptionKey extraction; Contao install tool /contao/install system reconfiguration and admin account creation; admin credential brute-force at /contao/login_check; tl_user SHA-512 (Contao <4.8) or bcrypt (4.8+) hash extraction with admin=1 superadmin identification — SHA-512 hashes GPU-crackable; tl_session active PHP session ID enumeration enabling instant backend replay without password; tl_member frontend member PII and password hash extraction; files/ directory PHP execution verification; Contao extension inventory for CVE detection.
Read →Neos CMS PHP Flow security testing: Configuration/Settings.yaml MySQL or PostgreSQL persistence.backendOptions.password extraction; admin credential brute-force at /neos/authentication/authenticate; neos_flow_security_account bcrypt hash extraction with ROLE_NEOS_ADMINISTRATOR role identification; Neos GraphQL API /graphql unauthenticated content enumeration (Neos 8+); neos_contentrepository_domain_model_nodedata hidden node content enumeration; Fusion template language SSTI assessment; /Configuration/ web accessibility verification; Flow Package Manager PHP code execution risk.
Read →eZ Platform and Ibexa DXP PHP enterprise CMS security testing: .env DATABASE_URL MySQL password and APP_SECRET Symfony session key extraction; admin/publish legacy default credential brute-force at /login_check; ezuser SHA-256 (password_hash_type=5, GPU-crackable) or bcrypt (type=7) hash extraction; eZ REST API /api/ezp/v2/user/users authenticated user enumeration; ezcontentobject draft status=0 unpublished content access; ezcontentobject_attribute PII field enumeration; Ibexa /api/ibexa/v2/ endpoint assessment.
Read →Fork CMS PHP Symfony security testing (popular in Belgium/Netherlands): app/config/parameters.yml MySQL database_password and Symfony secret token extraction; admin credential brute-force at /private/en/authentication/login; users bcrypt hash extraction with is_god=1 superadmin identification; Media Library file upload to /files/ with PHP execution verification for web shell RCE; modules_settings API key and integration credential enumeration; pages and blog_posts draft content access; /app/config/ web accessibility verification.
Read →Plone Python CMS (Zope) security testing: zope.conf RelStorage PostgreSQL DSN password extraction; ZMI /manage IP restriction verification — authenticated ZMI access enables Python Script arbitrary code execution as Zope process user (RCE); acl_users ZODB SSHA (SHA-1+salt) or bcrypt hash extraction from Data.fs object database; Plone REST API /plone/@users and /plone/@groups user and role enumeration; @registry sensitive configuration key audit; inituser emergency user file (MD5 plaintext) detection; default admin/admin and admin/secret credential testing.
Read →Apostrophe Node.js CMS (Express/MongoDB) security testing: data/local.js MongoDB URI password and SESSION_SECRET Express session signing key extraction; admin credential brute-force at /login; apostrophe-users bcrypt hash extraction with admin _groups identification; Apostrophe 3.x REST API /api/v1/@apostrophecms/user enumeration; attachment upload MIME bypass for /uploads/ web shell RCE; apostrophe-workflow draft content enumeration; MongoDB port 27017 unauthenticated access assessment; /data/local.js web accessibility verification.
Read →Wagtail Django CMS security testing: settings.py SECRET_KEY Django session/CSRF forgery + DATABASES PostgreSQL PASSWORD extraction; admin credential brute-force at /admin/login/ (configurable path); auth_user PBKDF2-SHA256 hash extraction with is_superuser=True identification; Wagtail API v2 /api/v2/pages/ unauthenticated content enumeration; wagtailcore_revision draft page content database access; wagtailcore_page unpublished page enumeration; embed SSRF via EmbedFinder; settings.py and .env web accessibility verification.
Read →Payload CMS TypeScript/Node.js headless CMS security testing: .env MONGODB_URI or POSTGRES_URL database credential extraction; PAYLOAD_SECRET JWT signing key extraction enabling admin token forgery without credentials; admin credential brute-force at /api/users/login; users collection bcrypt hash extraction with roles:admin identification; REST API /api/users and GraphQL /api/graphql Users collection enumeration; upload collection MIME bypass for web shell; versions collection draft content access; /api/graphql introspection exposure.
Read →SvelteKit security testing: any VITE_ prefixed environment variable is inlined into the client JavaScript bundle at build time — VITE_DATABASE_URL, VITE_SECRET_KEY readable by any visitor; SSR load functions using module-level variables share state across concurrent user requests causing cross-user data leakage; +server.ts API endpoints have no authentication by default; SvelteKit's built-in CSRF protection disabled by checkOrigin: false; +page.server.ts __data.json endpoints expose serialized load() data without additional auth checks.
Read →Nuxt 3 security testing: NUXT_PUBLIC_ prefixed env variables are serialized into the window.__NUXT__ payload embedded in every server-rendered page — NUXT_PUBLIC_API_SECRET, NUXT_PUBLIC_DATABASE_URL readable by any user; runtimeConfig.public keys are embedded in HTML for all visitors; Nitro server API routes under /server/api/ have no authentication middleware by default; useState() with static keys shares SSR state across concurrent user requests; /_ipx/ image proxy enables SSRF via remote URL injection; Nuxt DevTools must not be enabled in production.
Read →Remix (React Router v7) security testing: every route loader() is accessible as a JSON API endpoint via ?_data= query parameter — unauthenticated loaders expose all data as a public API; action() functions have no built-in CSRF protection — cross-site form submission is possible without explicit CSRF token validation; createCookieSessionStorage with weak SESSION_SECRET is crackable via HMAC-SHA256 brute-force enabling session forgery; resource routes (file downloads, data exports, webhooks) commonly lack authentication checks applied to page routes.
Read →Cisco ASA security testing: CVE-2018-0101 heap buffer overflow (CVSS 10.0) in SSL VPN webvpn XML parser enabling unauthenticated RCE; CVE-2020-3259 memory disclosure exposing active VPN credentials (exploited by Akira ransomware); CVE-2023-20269 unauthenticated brute force against SSL VPN tunnel groups; ASDM management interface credential attacks; CVE-2022-20828 ASDM command injection; REST API config extraction exposing LDAP bind passwords and RADIUS shared secrets in cleartext; AnyConnect VPN profile XML extraction revealing internal network topology.
Read →Check Point Security Gateway security testing: CVE-2024-24919 unauthenticated arbitrary file read via /clients/MyCRL POST request exposing /etc/shadow password hashes and SSH private keys (exploited by nation-state actors, added to CISA KEV May 2024); CVE-2023-28467 Mobile Access portal information disclosure; SmartConsole management server default credential attacks; SIC activation key brute force enabling gateway-management trust compromise; CPMI protocol (TCP 18264) enumeration; REST API policy database extraction revealing full network topology and LDAP/RADIUS credentials.
Read →SonicWall security testing: CVE-2021-20016 unauthenticated SQL injection in SMA100 SSL VPN /cgi-bin/sslvpnclient (CVSS 9.8) enabling credential and session token theft; CVE-2021-20028 improper input neutralization; CVE-2022-22274 heap buffer overflow in SonicOS HTTPS service (CVSS 9.4); CVE-2023-44221 authenticated OS command injection; default admin/password management credential testing; NSM API enumeration; SonicOS REST API /api/sonicos/ config backup and LDAP/RADIUS credential extraction; SMA100 session token abuse for VPN access bypass; SNMP community string extraction via SonicWall-specific MIBs.
Read →ManageEngine security testing: CVE-2022-47966 unauthenticated RCE via forged SAML assertion using Apache Santuario SHA1 bypass (CVSS 9.8, affects 24+ products, exploited by nation-state actors); CVE-2021-44077 ServiceDesk Plus unauthenticated JSP webshell upload via /RestAPI/ImportTechnicians (CVSS 9.8); CVE-2022-35405 PAM360 XMLRPC deserialization (CVSS 9.8) via ysoserial gadget chains; default admin/admin credential testing across all 12 product lines; REST API bulk credential export from PAM360 Account endpoint; embedded PostgreSQL extraction from webshell access; ADManager Plus Domain Admin-equivalent password reset; ADSelfService Plus MFA bypass via CVE-2021-40539.
Read →Cisco IOS XE security testing: CVE-2023-20198 unauthenticated privilege escalation via WebUI HTTP POST to /webui/logoutconfirm.html creating level-15 backdoor user (CVSS 10.0, exploited against 40,000+ devices in Oct 2023); CVE-2023-20273 command injection via WebUI enabling Lua implant deployment; Smart Install protocol (TCP 4786) unauthenticated config theft and rewrite exploited by APT groups; SNMP community string brute force with CISCO-CONFIG-COPY-MIB TFTP config exfiltration; RESTCONF/NETCONF API credential extraction via YANG path enumeration; IOS XE Type 7/5/8/9 password cracking; TACACS+/RADIUS shared secret extraction from running-config.
Read →SAP NetWeaver security testing: CVE-2020-6287 RECON unauthenticated RCE via LM Configuration Wizard SOAP endpoint on AS Java 7.30-7.50 creating SAP_ALL admin account (CVSS 10.0, discovered by Onapsis); CVE-2022-22536 HTTP request smuggling in SAP Web Dispatcher and ICM enabling session hijacking and loopback trust bypass (CVSS 10.0, SAP Note 3123396); SAP Management Console (port 5{NR}13) unauthenticated OS command execution via sapcontrol OSExecute; Message Server HTTP monitor rogue RFC gateway registration; SAP*/06071992 kernel backdoor default credentials; SM69/SM49 ABAP external OS commands; RFC_READ_TABLE USR02 BCODE hash extraction; DEFAULT.PFL database credential parsing.
Read →Juniper Networks security testing: CVE-2023-36845 PHP file inclusion via J-Web without authentication (CVSS 9.8, chained with CVE-2023-36844 for RCE, exploited in the wild Oct 2023); CVE-2022-22241 path traversal enabling pre-auth file read; J-Web admin credential brute force; Junos REST API /rpc/ endpoint enumeration extracting routing tables, interface configs, and LLDP neighbor data; NETCONF/YANG (port 830) session credential extraction; $9$ Junos password encoding decode and offline crack; SRX firewall VPN pre-shared key extraction; EX switch SNMP community credential enumeration.
Read →Sophos XG Firewall security testing: CVE-2020-12271 pre-authentication SQL injection via User Portal and HTTPS admin interface (exploited by Asnarok worm to drop Trojan.Asnarok, full RCE); CVE-2022-1040 authentication bypass in User Portal and Webadmin (CVSS 9.8, exploited by APT41/Chinese-nexus actors); admin portal default credential attacks; PostgreSQL syslog database credential extraction via sqlmap; Sophos Central API key abuse for policy enumeration and multi-device management; VPN credential harvesting from bookmark configurations; SSL/TLS inspection certificate extraction enabling MITM pivot.
Read →Cisco Meraki security testing: Dashboard API key extraction from JavaScript bundles, git repositories, and environment files enabling full org/network enumeration via api.meraki.com/api/v1/; organization admin user enumeration via /organizations/{id}/admins; MX appliance client VPN PSK extraction via /networks/{id}/appliance/vpn/siteToSiteVpn; Systems Manager MDM device enrollment certificate abuse; Wi-Fi PSK harvest via /networks/{id}/wireless/ssids; Meraki webhook receiver secret brute force; camera snapshot API for physical security bypass; network topology mapping via LLDP and CDP data in Meraki dashboard API.
Read →Apache Struts 2 security testing: CVE-2017-5638 Content-Type OGNL injection (CVSS 10.0) — the Equifax breach vector exposing 147 million records via a single malformed HTTP header; CVE-2018-11776 namespace OGNL injection without plugin dependency (CVSS 10.0); CVE-2021-31805 forced double evaluation (CVSS 9.8); S2-045 and S2-046 exploitation; REST plugin XStream deserialization gadget chain; Struts2 Showcase app detection and WAR deployment via Tomcat Manager; Metasploit struts2_content_type_ognl, struts_code_exec_exception_delegator, struts2_namespace_ognl modules; nuclei bulk scanning templates.
Read →JBoss and WildFly security testing: CVE-2017-12149 HTTP Invoker deserialization RCE (CVSS 9.8) via EJBInvokerServlet and JMXInvokerServlet; CVE-2015-7501 RMI/HTTP deserialization used in mass exploitation campaigns; CVE-2017-7504 JMXInvokerServlet gadget chain; unauthenticated JMX Console WAR deployment via MainDeployer MBean HtmlAdaptor; ysoserial gadget chain spray across Commons Collections 1-6, Spring, BeanUtils; WildFly management REST API (ports 9990/9999) datasource credential extraction; Metasploit jboss_invoke_deploy, jboss_deserializ modules; default admin/admin credential brute force.
Read →IBM WebSphere Application Server security testing: CVE-2020-4450 IIOP deserialization RCE (CVSS 9.8) via ysoserial gadget chains on CORBA port 2809; CVE-2019-4279 OS command injection in Integrated Solutions Console via JVM property manipulation; CVE-2021-29754 HTTP request smuggling (TE.CL) for session hijacking; SOAP connector (port 8880) AxisServlet enumeration and CVE-2020-4276 deserialization; default credential spray (wsadmin/wsadmin, WebSphere/WebSphere1, admin/admin); was.env and security.xml {xor} encoded password extraction; ltpa.keys LTPA token decryption; admin REST API /ibm/api/ resource enumeration; Nuclei custom template for console detection.
Read →MOVEit Transfer security testing: CVE-2023-34362 SQL injection leading to RCE (CVSS 9.8) — the Cl0p ransomware campaign affecting 2000+ organizations including BBC, British Airways, Shell, and US government agencies; CVE-2023-35036 and CVE-2023-35708 patch bypass variants; time-based blind SQLi against MSSQL (WAITFOR DELAY) and MySQL (SLEEP); webshell deployment via human2.aspx replicating Cl0p TTPs in C:\MOVEitTransfer\wwwroot\; SFTP server credential brute force and guestaccess.aspx folderid enumeration; moveitmf_users hash extraction (SHA-1 with InstCode+Password+Salt); Azure Blob Storage key extraction from moveitmf_settings; moveitmf_filedata VARBINARY(MAX) file content exfiltration; machine.aspx REST API token acquisition and user enumeration.
Read →VMware Horizon security testing: Log4Shell (CVE-2021-44228) JNDI injection through /broker/xml username field exploited by nation-state actors (CISA AA22-320A); DNS/LDAP callback detection and marshalsec LDAP redirector RCE chain; WAF bypass payload variants (nested/unicode/upper-case); ADAM LDAP enumeration with real Horizon base DN (dc=vdi,dc=vmware,dc=int) for desktop pool entitlements and vCenter service account extraction; JMX debug port (localhost:18443) exposure; admin console default credential brute force; Horizon Composer MSSQL vCenter credential extraction with DPAPI decryption; UAG REST API (port 9443) default admin/admin configuration extraction; SAML unsigned assertion bypass; Blast Secure Gateway info endpoint enumeration; vdm_server.config credential extraction via DPAPI.
Read →Barracuda ESG security testing: CVE-2023-2868 (CVSS 9.8) pre-auth RCE via qx{} Perl TAR filename injection exploited as a 0-day by UNC4841 (Chinese state-sponsored, Mandiant attribution) from October 2022 targeting 200,000+ appliances; Python PoC building malicious TAR archive delivered via SMTP; SEASPY persistent backdoor disguised as BarracudaMailService with BPF socket enumeration; SALTWATER trojanized bsmtpd module detection via ldd anomaly check; SUBMARINE SQL trigger-based persistence in SQLite (sqlite_master enumeration for load_extension/system calls); WHIRLPOOL backdoor long-lived TLS connection detection; management interface (port 8000) default credential brute force; LDAP/AD bind credential extraction from SQLite; Postfix sasl_passwd SMTP relay credential extraction; quarantine archive enumeration and email header injection testing.
Read →Comprehensive Apache ActiveMQ security testing guide: CVE-2023-46604 unauthenticated RCE via ClassInfo deserialization, admin console exposed without authentication, default admin/admin credentials, OpenWire protocol exploitation, and message queue poisoning in enterprise ActiveMQ deployments.
Read →Apache ActiveMQ security testing guide: Default admin/admin credentials on port 8161; CVE-2023-46604 critical RCE via OpenWire protocol (CVSS 10.0); Jolokia JMX API allows queue manipulation and credential extraction; unauthenticated message queues expose sensitive business data.
Read →Comprehensive Apache OFBiz security testing guide covering CVE-2024-38856 (CVSS 9.8 authentication bypass), CVE-2023-49070 pre-auth RCE via XML-RPC, CVE-2023-51467 URL manipulation bypass, Groovy script injection via ViewHandlerExt, JDBC credential exposure, and Entity Engine REST API abuse. Systematic OFBiz ERP security assessment.
Read →Auth0 security testing guide: Auth0 Management API tokens grant complete tenant control; client secrets stored in application configs are frequently exposed; the /oauth/token endpoint accepts password grant for users without MFA; public applications expose client_id enabling social engineering and token theft.
Read →AWS CloudFront security testing guide: CloudFront distributions often allow direct origin access without CloudFront authentication; cache poisoning via Host header and X-Forwarded-Host manipulation; signed URL/cookie bypass via parameter manipulation; OAC/OAI misconfiguration allows direct S3 access; Lambda@Edge function injection.
Read →How to conduct penetration testing on AWS environments. Covers IAM misconfiguration, S3 bucket exposure, metadata service attacks, privilege escalation paths, and the tools pentesters use.
Read →Bitbucket security testing guide: Bitbucket app passwords and OAuth tokens grant full repository access; Pipelines variables store secrets accessible in build logs; webhook secret validation is often disabled; repository access controls allow forking private repos; Bitbucket Data Center admin API is frequently internet-exposed.
Read →How to test for business logic vulnerabilities — the class of flaws that automated scanners can't find. Covers price manipulation, workflow bypass, account abuse, and race conditions with real examples.
Read →Comprehensive Citrix ADC and NetScaler security testing guide covering CVE-2023-3519 unauthenticated RCE, NSCONFIG credential extraction, management interface exposure, virtual server enumeration, and SAML SSO abuse. Essential reference for authorized NetScaler penetration testing engagements.
Read →Comprehensive Atlassian Confluence security testing guide covering CVE-2023-22527 OGNL injection RCE (CVSS 10.0), CVE-2022-26134 RCE, REST API token abuse, anonymous space access misconfiguration, user enumeration, macro injection, and Jira integration credential exposure.
Read →How to test for CORS misconfigurations in web applications. Covers reflected origins, null origin, wildcard with credentials, subdomain trust, and real exploitation scenarios with remediation.
Read →A technical guide to testing email infrastructure security. Covers SPF, DKIM, DMARC validation, email spoofing tests, SMTP security, and header analysis with command-line tools.
Read →Comprehensive F5 BIG-IP security testing guide covering CVE-2022-1388 iControl REST API unauthenticated RCE, CVE-2021-22986, TMSH configuration enumeration, management interface testing, BIG-IP ASM bypass, and iRules credential exposure. Essential reference for authorized F5 BIG-IP penetration testing.
Read →Comprehensive Fortinet FortiGate security testing guide covering CVE-2022-40684 authentication bypass, CVE-2023-27997 SSL VPN heap overflow, FortiOS REST API enumeration, management interface exposure, and FortiGate configuration extraction. Essential reference for authorized FortiGate penetration testing.
Read →GitHub Actions introduces unique security risks: secret injection, workflow poisoning, OIDC misconfiguration, and pull-request-based attacks. Learn how to test and secure your Actions pipelines.
Read →Comprehensive GitHub Enterprise Server (GHES) security testing guide covering management console attack surface, SAML authentication bypass, SSH key enumeration and abuse, personal access token exfiltration via GitHub API, webhook credential theft, Actions runner compromise, and GHES-specific misconfigurations. Distinct from github.com attack surface.
Read →HIPAA Technical Safeguards security testing guide: test access controls, audit logging, transmission security, and encryption for ePHI-handling web applications. Covers §164.312 requirements with practical assessment commands.
Read →HL7 FHIR security testing guide: FHIR servers expose patient records via unauthenticated REST API in development configs; $export bulk operation downloads entire patient dataset; SMART on FHIR scope misconfiguration allows cross-patient data access; FHIR search parameters enable patient enumeration without direct ID knowledge.
Read →Comprehensive Ivanti Connect Secure (Pulse Secure) security testing guide covering the CVE-2023-46805 authentication bypass + CVE-2024-21887 command injection chain, blind SSRF, credential extraction from config.cfg, and web shell persistence. Essential reference for authorized Ivanti VPN penetration testing.
Read →JFrog Artifactory security testing guide: default admin/password credentials, API key exposure in .npmrc and .gradle files, anonymous repository access, artifact poisoning, Docker registry abuse, and webhook exploitation.
Read →Comprehensive Kong Gateway security testing guide: Kong is the most widely deployed open-source API gateway — the Admin API (port 8001) exposes all routes, services, and consumers with no auth by default; API keys and JWT credentials stored in the Kong database are enumerable; rate limiting plugins can be bypassed; and misconfigured route ACLs grant unauthorized backend access. This guide covers s...
Read →Comprehensive LangChain security testing guide: LangChain applications are built on top of LLMs and give those models tools — file system access, web browsing, code execution, database queries, and API calls. Prompt injection attacks can redirect agents to exfiltrate data or execute unauthorized tool calls; memory components leak prior conversation context; vector database retrieval can be poisone...
Read →Microsoft SQL Server security testing guide: SA account with blank password is common in legacy installs; xp_cmdshell enables OS command execution; linked servers chain privilege escalation across instances; SQL Agent jobs execute arbitrary OS commands; database credentials in connection strings are widely exposed.
Read →Comprehensive Microsoft SQL Server security testing guide: xp_cmdshell for OS command execution, linked server lateral movement, credential exposure via master keys and SQL Agent jobs, UNC path injection for hash capture, and sa account abuse in enterprise MSSQL deployments.
Read →Hands-on guide to Microsoft Teams security testing: OAuth token theft, Microsoft Graph API enumeration, webhook abuse, TeamsPhisher phishing, Teams app sideloading, and chat data exfiltration — with curl and Python examples for authorized pentesters.
Read →MongoDB Atlas security testing guide: Atlas connection strings with embedded credentials are widely exposed in environment variables and application configs; Atlas API keys grant full cluster management; network access whitelists with 0.0.0.0/0 allow connections from any IP; Atlas Data API provides HTTP access to MongoDB without standard client restrictions.
Read →MQTT security testing guide: MQTT brokers (Mosquitto, EMQX, HiveMQ) allow anonymous connections by default on port 1883; wildcard subscriptions (#) enumerate all topics including device telemetry and credentials; retained messages expose historical sensor data; no TLS on port 1883 allows credential interception.
Read →Node-RED security testing guide: The editor UI on port 1880 has no authentication by default; Function nodes execute arbitrary Node.js code; exec nodes run shell commands; credentials in flows_cred.json can be decrypted; HTTP In nodes create unauthenticated web endpoints.
Read →Comprehensive nopCommerce security testing guide: App_Data/Settings.txt exposes SQL Server connection strings in plaintext; the REST API uses Nop-Api-Key header authentication; admin panel is exposed at /Admin; plugin upload functionality allows arbitrary .NET code execution; and .NET-specific issues including MachineKey exposure and ViewState misconfiguration. This guide covers systematic nopComm...
Read →Comprehensive Okta security testing guide: Okta SSWS API tokens grant full admin access; the /api/v1/users endpoint enumerates all users without pagination limits when using admin tokens; OAuth2 app client secrets stored in environment variables are frequently exposed; and Okta logs reveal authentication flow details useful for targeted attacks.
Read →Comprehensive Okta security testing guide: SSO authentication bypass via SAML response manipulation, API token exposure through misconfigured scopes, IdP enumeration, OAuth implicit flow abuse, and Okta admin console access control gaps in enterprise identity deployments.
Read →Comprehensive Oracle WebLogic security testing guide covering CVE-2020-14882 unauthenticated RCE, T3/IIOP deserialization attacks, JNDI injection via admin console, WebLogic SSRF chains, credential extraction from config.xml, and WLST abuse. Essential reference for authorized WebLogic penetration testing engagements.
Read →Comprehensive Palo Alto PAN-OS security testing guide covering CVE-2024-3400 OS command injection via GlobalProtect, management interface exposure, Expedition credential extraction, XML API authentication bypass, and firewall configuration enumeration. Essential reference for authorized PAN-OS penetration testing.
Read →Comprehensive Microsoft SharePoint security testing guide covering NTLM relay attacks, NTLM hash capture with Responder, REST API enumeration via _api/web/lists, ASPX webshell upload to document libraries, CVE-2023-29357 authentication bypass EoP/RCE, SSRF via workflows, and SharePoint Online vs on-prem differences.
Read →Comprehensive Slack security testing guide covering xoxb bot token exposure in repos and environment variables, xoxp user token harvesting, incoming webhook URL abuse for SSRF and message injection, Slack API data exfiltration via conversations.history and files.list, OAuth app abuse, and slash command SSRF. Essential reference for authorized Slack pentest engagements.
Read →Comprehensive JetBrains TeamCity security testing guide covering CVE-2024-27198 unauthenticated RCE, CVE-2024-27199 path traversal, build agent secret theft, token exfiltration from TeamCity REST API, pipeline injection, and VCS root credential extraction. Covers both on-premises and TeamCity Cloud attack surfaces.
Read →Comprehensive VMware vSphere and ESXi security testing guide covering CVE-2021-21985 vCenter Server RCE, CVE-2021-22005 file upload RCE, ESXiArgs ransomware attack chain, ESXi host direct access, vSphere API enumeration, and vCenter credential extraction. Essential reference for authorized VMware penetration testing.
Read →A practical guide to testing web server security configurations for Nginx, Apache, and IIS. Covers server banner disclosure, directory listing, dangerous modules, header configuration, and hardening verification.
Read →Comprehensive WooCommerce security testing guide: WooCommerce is the most widely deployed e-commerce platform — WordPress admin panel and WooCommerce REST API use the same credential set; Consumer Key/Secret pairs grant full order and customer data access; third-party plugins introduce RCE, SQLi, and file upload vulnerabilities; the wp_woocommerce_order_items table stores complete payment and cust...
Read →Comprehensive guide to Zendesk security testing: API token exposure, ticket data enumeration, OAuth misconfiguration, subdomain takeover on Help Center subdomains, widget injection, and trigger/webhook SSRF. Curl examples and hardening guidance included.
Read →Comprehensive Zimbra Collaboration Suite security testing guide: admin/zimbra are the well-known default credentials; CVE-2022-41352 achieves unauthenticated RCE via cpio archive unpacking in Amavis (CVSS 9.8); CVE-2022-27925/37042 combine auth bypass with mboximport RCE; the admin console on port 7071 exposes full account management; SSRF via ProxyServlet reaches internal infrastructure; zimbraPr...
Read →Comprehensive Zoom security testing guide covering API key and JWT credential exposure, meeting bombing and hijacking techniques, webhook SSRF via Event Subscriptions, OAuth token theft, cloud recording access, and CVE-2022-22786 path traversal.
Read →Comprehensive Veeam Backup & Replication security testing guide covering CVE-2023-27532 unauthenticated credential API access, CVE-2024-40711 SSRF-to-RCE deserialization chain, REST API enumeration, PostgreSQL database credential extraction, backup repository credential harvesting, and Enterprise Manager vault attacks. Essential reference for authorized Veeam penetration testing.
Read →Comprehensive MikroTik RouterOS security testing guide: CVE-2018-14847 CVSS 9.1 unauthenticated WinBox file read extracting /flash/rw/store/user.dat credentials; CVE-2023-30799 privilege escalation admin-to-superadmin via REST API; RouterOS API TCP 8728 Python exploitation; SNMP community string config dump; IPsec PSK extraction; DNS hijacking campaigns; chimay-red and RouterSploit attacks; WebFig...
Read →Complete security testing guide for Zyxel firewalls and VPN gateways. Covers CVE-2023-28771 pre-auth IKEv2 RCE, CVE-2022-30525 ZTP command injection, hardcoded zyfwp credentials, SNMP enumeration, configuration backup extraction, and IPsec VPN credential exposure.
Read →Comprehensive CyberArk PAM security testing guide: PVWA REST API authentication, default credential abuse (Administrator/Cyberark1), bulk vault credential extraction via /api/Accounts, Conjur JWT secret enumeration, DBParm.ini vault key extraction, and Privileged Session Manager (PSM) bypass techniques. Essential reference for authorized CyberArk penetration testing.
Read →Complete guide to Qualys VMDR security testing: API key theft via source code and config files, scanner appliance default credential exploitation (qualys/qualys SSH), cloud agent activation key abuse for rogue agent registration, integration credential extraction (AWS, ServiceNow, Jira, Splunk), and WAS stored application credential recovery. Essential for authorized Qualys penetration testing.
Read →Comprehensive Tenable Nessus and Security Center security testing guide: REST API session token theft, default credential exploitation, policy file scan credential extraction (SSH/Windows/SNMP stored in /opt/nessus/var/nessus/), master.key decryption, Tenable.sc token-based API enumeration, Tenable.io bulk vulnerability export, and scanner network position abuse for lateral movement.
Read →Complete guide to SolarWinds Orion security testing: CVE-2020-10148 CVSS 10.0 authentication bypass, SUNBURST backdoor mechanics and IOCs, Orion REST API enumeration via SWIS, SWQL injection for credential table access, MSSQL database credential extraction, AES-encrypted credential decryption, SNMP community string harvest, and supply chain attack surface analysis. High-impact target: a compromised Orion server holds credentials for every monitored device in the network.
Read →Comprehensive PRTG Network Monitor security testing guide: CVE-2018-9276 CVSS 9.8 OS command injection via notification scripts, prtgadmin/prtgadmin default credentials, PRTG REST API passhash authentication abuse, sensor credential extraction from PRTG Configuration.dat XML files, SNMP community string harvest, DPAPI and AES credential decryption, and SYSTEM-level RCE via notification engine exploitation.
Read →Complete CrowdStrike Falcon security testing guide: API client secret exposure in CI/CD and SIEM configs, OAuth2 scope enumeration, Real-Time Response (RTR) shell abuse for RCE on all enrolled endpoints, sensor installation token extraction from Ansible/Puppet/SCCM deployments, Falcon Data Replicator S3 bucket misconfiguration and telemetry exposure, detection policy and exclusion enumeration for evasion visibility, and sensor maintenance token recovery for uninstall protection bypass.
Read →Complete Atlassian Bamboo security testing guide: CVE-2022-26133 CVSS 9.8 unauthenticated RCE via exposed Hazelcast cluster port (54663), ysoserial CommonsBeanutils1 gadget chain exploitation, bamboo.cfg.xml database credential extraction, build plan secret variable enumeration via REST API and direct DB access, remote agent authentication bypass and rogue agent registration for secret interception, linked repository SSH key and OAuth credential extraction, and post-exploitation pivot paths to cloud credentials and production deployments.
Read →Comprehensive CircleCI security testing guide: OIDC token theft for AWS/GCP/Azure credential hijacking via overly permissive IAM role trust policies, environment variable extraction through build log injection and malicious steps, context API secret enumeration with branch restriction bypass, 2023 security incident residual exposure assessment, API token abuse for cross-org pipeline enumeration, orb supply chain attack vectors via unpinned versions and typosquatted packages, fork PR context leakage, and post-exploitation via Docker registry, Kubernetes kubeconfig, and package signing credentials.
Read →Complete Veeam Backup & Replication security testing guide: CVE-2024-40711 CVSS 9.8 unauthenticated RCE via .NET Remoting deserialization (SYSTEM-level), CVE-2023-27532 pre-auth encrypted credential extraction from port 9401, VBR PostgreSQL database queries for backup job credentials and cloud keys, Veeam PowerShell credential decryption, ransomware operator TTPs (BlackBasta/Akira backup deletion patterns), vCenter/ESXi credential extraction, Instant VM Recovery abuse for DC credential extraction, and post-exploitation pivot paths through every protected system in the environment.
Read →Complete ConnectWise ScreenConnect security testing guide: CVE-2024-1709 CVSS 10.0 authentication bypass via SetupWizard path confusion creating rogue admin accounts, CVE-2024-1708 path traversal for arbitrary ASPX webshell write, combined pre-auth RCE chain exploited by BlackCat/ALPHV and LockBit within 24 hours of disclosure, session hijacking and access code enumeration, SQLite user credential extraction and SHA-256 hash cracking, API-driven mass endpoint enumeration across all enrolled machines, and observed ransomware TTPs including bulk tool deployment, Rclone exfiltration, and sequential ransomware execution across managed MSP endpoints.
Read →Complete ManageEngine ServiceDesk Plus security testing guide: CVE-2022-47966 CVSS 9.8 pre-auth RCE via Apache Santuario XMLDSig XSLT transform injection in SAML assertion processing, CVE-2021-44077 unauthenticated JSP webshell upload via ImportTechnicians REST endpoint (exploited by APT41/Moshen Dragon), AES-encrypted credential decryption from server.xml and pmpkey.key, MSSQL/HSQLDB credential and API key extraction, complete CMDB exfiltration via REST API, Active Directory bind credential abuse, password vault contents extraction, helpdesk ticket attachment harvesting, and post-exploitation network mapping from the ITSM asset inventory.
Read →Complete Imperva WAF security testing guide: SecureSphere MX Management Server default credential exploitation and REST API session abuse, Imperva Cloud WAF API ID/key exposure in Terraform state and CI/CD pipelines, WAF bypass via HTTP parameter pollution, chunked transfer encoding, Unicode obfuscation, header manipulation, and X-Forwarded-For spoofing, origin server IP discovery via DNS history and certificate fingerprinting, security rule enumeration via MX API, RASP bypass concepts, and high-impact post-exploitation from management console access including SSL private key extraction and global allowlist manipulation.
Read →Complete IBM QRadar SIEM security testing guide: default admin/admin console credentials, SEC API token extraction and authorized_services enumeration, SSH root access and inter-component key extraction, AQL query execution bypassing audit logging, WinCollect and JDBC log source credential theft, building block/rule export for detection evasion, reference set enumeration revealing monitoring scope, malicious App Framework container upload for code execution, Ariel database direct JDBC access, and offense suppression post-exploitation. CVE-2022-22944, CVE-2021-29842, CVE-2019-4283.
Read →Complete Tenable Nessus security testing guide: REST API session token and API key extraction, scan policy export containing SSH private keys and Windows domain credentials, nessus.db SQLite extraction with user and policy credential queries, bulk scan result exfiltration revealing full network vulnerability inventory, Nessus Agent linking key theft and rogue agent registration, Tenable.sc PostgreSQL access, custom NASL plugin upload for scanner-context code execution, and lateral movement via extracted scan credentials. CVE-2021-20099, CVE-2021-20100, CVE-2018-11366.
Read →Complete Microsoft Sentinel security testing guide: service principal client secret and certificate enumeration, Log Analytics workspace primary/secondary key extraction from ARM templates and Terraform state, direct REST API workspace queries for SecurityEvent and SigninLogs, KQL analytics rule and saved query export revealing detection logic, Logic App managed identity IMDS token extraction and playbook triggering via log injection, Microsoft Defender GraphAPI permission abuse, AWS S3 and CEF data connector credential exposure, Azure Lighthouse multi-tenant pivoting, and HTTP Data Collector API log injection with HMAC-SHA256 signing for covering tracks.
Read →Practical OWASP ZAP guide for web app security testing — spider/crawler setup, active scanning, fuzzer, manual intercept, scripts, REST API, and CI/CD integration. Covers daemon mode vs desktop GUI, AJAX Spider for SPAs, scan policy configuration, authentication scripting, Automation Framework YAML plans, and GitHub Actions integration. Honest comparison with Burp Suite on where ZAP wins and where it falls short.
Read →Comprehensive Snyk security testing guide: Snyk API tokens in CI/CD configs enable full org vulnerability data enumeration; service account tokens grant org admin; GitHub/GitLab/Bitbucket integration credentials enable SCM access; .snyk policy files reveal intentional ignores; webhook endpoints leak project scan results; Snyk Broker tokens in Kubernetes deployments expose internal SCM; and Snyk IaC cloud environment integration exposes AWS IAM keys, Azure service principals, and GCP service account credentials.
Read →Comprehensive Rapid7 InsightVM/Nexpose security testing guide: admin/admin default credentials on Security Console (3780/TCP), REST API v3 for full asset inventory and scan credential vault enumeration, PostgreSQL nexpose schema with dim_site_credential and dim_credential_account credential extraction, scan engine shared secret from nse.xml enabling console API impersonation, nxconsole.xml database and admin credential extraction, Metasploit Pro integration API key theft for automated exploit launching, and Insight Agent enrollment token abuse. CVE-2019-5638 SSRF, CVE-2021-31862 XSS.
Read →Comprehensive Trivy security testing guide: registry credential exposure in ~/.docker/config.json and Kubernetes secrets enabling private image pull access and lateral movement, .trivyignore and .checkov.yaml suppression abuse hiding critical CVEs from pipeline gates, container image vulnerability scanning with plan-based dynamic value resolution, IaC and Kubernetes misconfiguration detection gaps, secret scanning blind spots for base64-encoded credentials and runtime-injected secrets, SBOM generation for supply chain attack surface analysis, CI/CD exit-code bypass patterns (--exit-code 0, continue-on-error), Trivy Server unauthenticated API abuse, and vulnerability database staleness exploitation for false negative coverage gaps.
Read →Complete BloodHound and SharpHound security testing guide: SharpHound ZIP output sensitivity and credential exposure assessment, BloodHound CE default admin:bloodhoundcommunityedition API access for complete AD graph enumeration, Neo4j direct Bolt/7474 access bypassing BloodHound authentication, Cypher queries for Kerberoastable service account discovery and prioritization, unconstrained delegation exploitation via Printer Bug / PetitPotam TGT capture, DCSync right enumeration via GetChanges/GetChangesAll and secretsdump execution for krbtgt hash extraction, ACL abuse chains (GenericAll, WriteDACL, WriteOwner, GenericWrite) from low-privileged users to Domain Admin, shortest path analysis for attack path quantification, and attack path reduction: gMSA adoption, Protected Users enforcement, and AdminSDHolder DACL hardening.
Read →Complete Checkov IaC security testing guide: Terraform misconfiguration scanning with plan-based dynamic value resolution for variable-dependent security groups and IAM policies, CloudFormation wildcard IAM policy detection gaps, Kubernetes manifest hardening checks (privileged containers, hostPID, hostNetwork, capabilities, seccomp), suppression audit via inline checkov:skip annotations and .checkov.yaml global skip-check abuse, custom Python and Rego policy development for organization-specific controls, CI/CD gate bypass analysis (soft_fail:true, continue-on-error, exit-code override), Bridgecrew API key exposure enabling full infrastructure posture enumeration and global suppression manipulation, and Checkov blind spots compared to tfsec, kube-bench, and runtime security tools.
Read →Complete Veeam Backup & Replication security testing guide: CVE-2024-40711 unauthenticated RCE via .NET deserialization on TCP 8000 (CVSS 9.8) exploited by Akira and Fog ransomware, CVE-2023-27532 credential extraction from the catalog service on TCP 9401 without authentication (CVSS 7.5, CISA KEV), VBR configuration database (SQL Server/PostgreSQL) credential extraction for all backup targets including vCenter service accounts and domain admins, DPAPI-encrypted credential decryption from SYSTEM context, Veeam Enterprise Manager CVE-2024-29849 auth bypass (CVSS 9.8), Cloud Connect tenant credential extraction, and ransomware operator kill chain TTPs used by Akira, BlackBasta, and Cuba ransomware groups.
Read →Complete ConnectWise ScreenConnect security testing guide: CVE-2024-1709 CVSS 10.0 unauthenticated authentication bypass via setup wizard path confusion enabling admin account creation (CISA Emergency Directive ED-24-01, weaponized by BlackCat/ALPHV, LockBit, and Bl00dy ransomware within 48 hours), CVE-2024-1708 path traversal enabling web shell and malicious extension upload for SYSTEM-level RCE, admin console default credential testing, SQLite database session key and credential hash extraction, ScreenConnect SYSTEM-level extension RCE with persistence, MSP multi-tenant attack chain giving simultaneous access to all client endpoints, attacker-installed ScreenConnect as persistence mechanism, and network hardening via admin IP restriction in web.config.
Read →Complete ManageEngine ServiceDesk Plus security testing guide: CVE-2022-47966 unauthenticated RCE via SAML XML signature deserialization (CVSS 9.8) exploited by nation-state APT groups per CISA/NSA Joint Advisory AA22-321A, CVE-2021-44077 pre-auth JSP file upload RCE (CVSS 9.8) via /RestAPI/ImportTechnicians exploited against US defense industrial base, admin console default credential testing (administrator/administrator), config file plaintext credential extraction (database_params.conf, DomainConfig.xml), PostgreSQL database extraction of LDAP bind credentials and all infrastructure integration secrets, AES encryption key derivation for stored password decryption, REST API IDOR and mass data export, ADSelfService Plus CVE-2021-40539 (CVSS 9.8), and ManageEngine product family attack surface across ADManager Plus, Endpoint Central, and Password Manager Pro.
Read →Complete SentinelOne XDR security testing guide: API token credential exposure in SIEM configs and CI/CD pipelines enabling full endpoint estate enumeration, Deep Visibility EDR telemetry query abuse for credential hunting across fleet command-line history (process creation arguments, .env file access, AWS credential usage), Remote Shell API exploitation for batch script execution on all managed Linux and Windows endpoints, agent passphrase extraction enabling uninstall of EDR protection, Ranger network discovery data enumeration revealing unmanaged asset inventory, detection exclusion and policy mode enumeration revealing detection gaps and Detect-Only endpoints, hash allow-list manipulation for persistent detection bypass, and hardening controls for API token expiration, Remote Shell access restriction, and audit log SIEM forwarding.
Read →Complete Wiz cloud security platform security testing guide: OAuth service account client ID and secret exposure in Terraform state, CI/CD pipelines, and SOAR configurations enabling security graph API access, GraphQL query abuse to enumerate all cloud misconfigurations, attack paths, and toxic combinations Wiz has mapped, Wiz secret detection API access revealing actual credentials (AWS keys, DB passwords, API tokens) scanned across the cloud estate, cloud account connector configuration extraction revealing IAM role ARNs and external IDs, CSPM issue and control enumeration for complete misconfiguration inventory, bulk issue rejection for alert suppression bypassing security posture visibility, new service account creation for persistence, and hardening controls for credential rotation, least-privilege scopes, and Activity Log SIEM forwarding.
Read →Complete Palo Alto Prisma Cloud CNAPP security testing guide: API access key and Bridgecrew BC_API_KEY exposure in Terraform state, GitHub Actions, and CI/CD pipelines, RQL query execution for arbitrary cloud resource enumeration (public S3 buckets, stale IAM access keys, Azure public storage), CIEM identity risk data extraction for overprivileged identity mapping and privilege escalation path analysis, Checkov/Bridgecrew policy suppression creation to bypass CI/CD IaC security gates, CSPM alert bulk dismissal to suppress security posture visibility, cloud account IAM role ARN and external ID extraction, Prisma Cloud Compute (CWPP) scanner token extraction from Kubernetes daemonset configs, Logic App playbook trigger abuse via log injection, and hardening controls for access key rotation, SSO enforcement, and audit log SIEM streaming via SQS.
Read →