Shay Rand

Shay Rand

4 followers

I am a Web Application Security Consultant and Pen Tester. I'm currently part of the AppSec team at Maglan - Accenture Security. All Views are my Own.

How to Discover SQL Injections

Jan 9, 20238 min read

A comprehensive writeup emphasizing the importance of context · The process of finding SQL injection vulnerabilities involves identifying user data...

How to Discover SQL Injections

Testing File Upload Mechanism

Jul 7, 20229 min read

Straightforward Approach to Hacking File Uploads · This past week I had the opportunity to test a file upload feature which only allowed pdf files to be...

Testing File Upload Mechanism

XXE - Underrated?

Jul 6, 20224 min read

How to Gain Access To All The Data - Tips Tricks and Resources · Disclaimer: The content of my articles is truly the hard work of researchers in the...

XXE - Underrated?

CSRF Revisited

Jul 5, 20226 min read

What you've been taught VS What you will see. · Pre-Conditions Portions of this article have been copied from Portswigger Academy. There are many other...

CSRF Revisited

SSRF Demystified

Jul 4, 20227 min read

From Detection To High Impact Exploitation · Introduction Server Side Request Forgery can technically be viewed as an Authorization issue as you are...

SSRF Demystified

IDOR - Broken Authentication

Jul 3, 202211 min read

Methods and Strategies to Break Authorization · IDOR - Background Info In our first example, what's stopping someone from checking another user's ID...

IDOR - Broken Authentication