https://footstep.ninja/Recent content on cat ~/footstep.ninja/blog.txtHugo -- gohugo.ioCopyright © 2020 - Shuaib OladigboluSat, 29 Dec 2018 00:00:00 +0000https://footstep.ninja/about/Sat, 29 Dec 2018 00:00:00 +0000https://footstep.ninja/about/Shuaib Oladigbolu is a CS student at Ladoke Akintola University of Technology and also a bug bounty hunter who helps companies secure their online assets.https://footstep.ninja/hof/Sat, 29 Dec 2018 00:00:00 +0000https://footstep.ninja/hof/ HackerOnehttps://footstep.ninja/posts/html-injection-in-email/Tue, 31 Dec 2019 22:21:09 +0100https://footstep.ninja/posts/html-injection-in-email/Sequel to my last post, I’ll be discussing about HTML injection on the same target. HTMLi is a vulnerability that can be exploited in any application that renders HTML code; email happens to be one.https://footstep.ninja/posts/idor-via-http/Tue, 31 Dec 2019 19:44:37 +0100https://footstep.ninja/posts/idor-via-http/Oh! Yea, HTTP is the most common channel you could find an Insecure Direct Object Reference (IDOR) Vulnerability (IMO). I should call this an IDOR series, hahah!https://footstep.ninja/posts/exploiting-self-xss/Tue, 31 Dec 2019 18:47:43 +0100https://footstep.ninja/posts/exploiting-self-xss/In this post, I’ll be talking about an interesting bug chain I discovered a few months ago; Stored XSS + IDOR (Cross Site Scripting and Insecure Direct Object Reference respectively).https://footstep.ninja/posts/idor-via-websockets/Sat, 23 Nov 2019 09:23:23 +0100https://footstep.ninja/posts/idor-via-websockets/In my previous post, I shared my love for testing Insecure Direct Object Reference (IDOR) vulnerability. This time I’ll be sharing the situation where I found an IDOR in Websockets.https://footstep.ninja/posts/websockets-testing/Sat, 23 Nov 2019 08:47:02 +0100https://footstep.ninja/posts/websockets-testing/Until a few months ago, I have only dealt with HTTP(S) endpoints. Then there was an application I was testing which I couldn’t figure out how it communicated to the server even though I am always logging every request with Burp Suite.https://footstep.ninja/posts/idor-via-email/Mon, 29 Jul 2019 07:08:31 +0100https://footstep.ninja/posts/idor-via-email/A year ago, I discovered an Insecure Direct Object Reference (IDOR) vulnerability which allowed anyone to reply to messages on behalf of other users on a website.https://footstep.ninja/posts/blog-documentation/Thu, 25 Jul 2019 10:48:39 +0100https://footstep.ninja/posts/blog-documentation/Hello everyone! I’m going to document the steps involved in setting up this blog so anyone can also pick it up as a guide when they want to do the same.https://footstep.ninja/posts/password-reset/Sun, 30 Dec 2018 07:46:08 +0100https://footstep.ninja/posts/password-reset/This post is about a misconfiguration in password reset I found on a popular help desk software sometimes ago where they were leaking the reset token.https://footstep.ninja/posts/hacken-cup/Sat, 29 Dec 2018 19:57:19 +0100https://footstep.ninja/posts/hacken-cup/I’ve got this down since the CTF and saw a few writeups on the same. Then I thought why not share my approach too :Dhttps://footstep.ninja/posts/hello-world/Sat, 29 Dec 2018 19:47:31 +0100https://footstep.ninja/posts/hello-world/Hello World! Yay! Finally, I made a blog. So, exactly a year ago today, I made a list of goals for this year, 2018.