Hacker's DayDream

HOME SERVICES BLOG

HOME SERVICES BLOG

🤖Arcanix Inc
Hacker's Day Dream
WWW
- 🦀OWASP
Tools
- 🧰Tools & Usage
Privilege Escalation
- 👾Linux Privilege Escalation
- 🪟Windows Privilege Escalation
Shells

Powered by GitBook

On this page

Was this helpful?

HTTP Verb Tampering

PreviousXML External Entity (XXE) Injection NextInsecure Direct Object References (IDOR)

Last updated 9 months ago

Identify & Exploit

Here we have a File Manager. The reset button is restricted for authenticated users only. We'll try to bypass that.

Up on capturing the request on burp and changing the request type from GET to POST

This didn't trigered the reset button. We'll try with HEAD request.

This time it worked as HEAD is very similer to GET and all the file are now deleted.

READ MORE.

Page cover image