Search for a command to run...
| Vulnerability Operations @ Synack | Bug Bounty Hunter. Security Researcher. Wannabe hacker, sharing my thoughts on how to be successful in the cyber security space, after pivoting careers of being a decade long Sales Director.
No comments yet. Be the first to comment.
Discovered by: Michael KimVendor: ui-lib (Uilibrary)Product: Stocky – POS with Inventory Management & HRM (“Ultimate Inventory Management System with POS”)Affected Version: 5.0 (as released June 2025)Impact: Arbitrary JavaScript Execution (Stored XSS...
Discovered by: Michael Kim & Sergio MedeirosVendor: iNiLabsProduct: School Express – School Management System (SMS Express)Affected Version: 6.2 (other versions not tested)Impact: Arbitrary JavaScript Execution (Stored XSS)Attack Type: Remote (Authen...
Discovered by: Michael Kim & Sergio MedeirosVendor: LiquidThemesProduct: MagicAI (a.k.a. MagicProject AI)Affected version: 9.1 (other versions untested)Impact: Arbitrary JavaScript execution in users’ browsers (stored XSS)Attack type: Authenticated r...
Introduction: As a seasoned cybersecurity researcher and penetration tester, I am constantly on the lookout for certifications that sharpen my skills and keep me at the forefront of web application se
The Power of Simplicity: A Bug Bounty Tale with Big Results
Finally! As promised, I am sharing my tips and tricks on how to pass the eWPTXv2 exam by INE and eLearnSecurity on your first attempt, using nothing but free resources. This exam is by far the hardest exam that I have taken to date, and I thought it would be the one that ends my streak when it comes to passing certification exams on my first pass. But.. I did it.
But of course, if you'd like proof, here it is: https://verified.elearnsecurity.com/certificates/a7cdc42b-bb12-4e72-bdfe-96105864d55e
All jokes aside, if you struggled through the eWPT exam, then you are not ready for the eWPTXv2 exam. In my opinion, INE/eLS should have created a certification in-between the eWPT and eWPTX given the degree of difficulty. If you struggle with Java Deserialization RCEs, Server Side Template Injections, PHP Object Injections, advanced SQLmap usage or the ability to chain vulnerabilities together, then you may want to hit the labs. I suggest being comfortable in reading code, along with being able to write simple scripts with a focus on PHP! ;) However, don't fret! I am outlining the resources I used to prepare, and some of the vulnerabilities to anticipate for your journey ahead.
Also, I am available on Twitter @grumpzsux if you have any questions, please feel free to shoot me a DM.
However, I will NOT be giving out any answers! If I had to feel the pain and sleep in a puddle of my own tears in the fetal position, you shall too!
Let's get this party started.
PHP Object Injection
Java Deserialization
https://www.n00py.io/2017/11/exploiting-blind-java-deserialization-with-burp-and-ysoserial/
https://securitycafe.ro/2017/11/03/tricking-java-serialization-for-a-treat/
https://blog.afine.com/testing-and-exploiting-java-deserialization-in-2021-e762f3e43ca2
Server Side Template Injection (SSTI)
https://ajinabraham.com/blog/server-side-template-injection-in-tornado
https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
Server Side Request Forgery (SSRF)
https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-localhost
https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-backend-system
Second Order SQL Injection
Note: please do not depend on SQLmap for each SQL injection that you find, not all of them can be exploited using SQLmap, and you may need to exploit them manually. In this case, be sure that you understand why you are using special characters like
'or#when testing manually. ;)
Anti-CSRF Token Bypass using SQLmap
https://forum.hackthebox.com/t/bypassing-web-application-protections-sqlmap-essentials/267869
https://neutronsec.com/tools/sqlmap/bypassing_web_protections/
Out-of-Band (OOB) XML eXternal Entity Injection
https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-interaction
https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-exfiltration
Host Header Injection
De-Obfuscate JavaScript Code
PHP Coding Resources
Stored Cross Site Scripting (SXSS) <-- assuming you're 31337 already
Reflected Cross Site Scripting (RXSS) <-- assuming you're 31337 already
Time-Based SQL Injection (SQLi) <-- assuming you're 31337 already
Just to finish this article off, please ensure that your enumeration through each phase of the cyber kill chain is diligent. Don't be afraid to dig deep, checking for hidden directories, subdomains, and endpoints that can be used to craft attack chains. Just because you find one vulnerability, don't stop there, see if there is a way to chain that vulnerability to another vulnerability to create a more impactful attack chain. ;)
I feel that this exam is worth doing if you are going to focus on web applications, I feel the attack chains are modern, and not as out dated compared to the eWPT exam. Given that I triage reports for a living at Synack, I am exposed to web app vulnerabilities all day, and it aligns fairly well compared to what is being submitted currently.
Critical thinking is what will make you successful.
Good luck my fellow nerds. - Sergio Medeiros