Application-Security on krash.dev

VS Code Security: Looking at the IDE from Security Lens

Thu, 14 Sep 2023 00:00:00 +0000

While perusing StackOverflow's 2023 Developer Survey (yes, we developers have our own version of celebrity gossip), I couldn’t help but notice that our trusty VSCode is still riding high as the undisputed IDE champ. With a whopping 73% of the developer vote, it’s safe to say that VSCode has firmly planted its flag. But, like any superstar, it’s not immune to the spotlight’s glare, especially when it comes to security. And in this blog, we’ll explore the security aspects that every VSCode user should consider.

gRPC: We are not RESTing Anymore

Sat, 02 Jul 2022 00:00:00 +0000

gRPC is a framework which is being used to build scalable and fast APIs. The framework from which it derives most of its positives is from the protocol it uses - HTTP/2. Apart from HTTP/2, it uses protocol buffer (protobuf) for the communication.

gRPC can be useful in circumstances like -

large-scale microservices connections
real-time communication
Low power & low bandwidth systems
Multi-language environments

Why Should We Care? Let’s talk Benefits#

The use of HTTP/2 over the TLS end-to-end encryption connection in gRPC ensures API security.
gRPC provides built-in support for commodity features, such as metadata exchange, encryption, authentication, deadline/timeouts and cancellations, interceptors, load balancing, service discovery, and so much more.
The prime feature of gRPC methodology is the native code generation for client/server applications.
gRPC tools and libraries are designed to work with multiple platforms and programming languages, including Java, JavaScript, Ruby, Python, Go, Dart, Objective-C, C#, and more.
Parsing with Protobuf requires fewer CPU resources since data is converted into a binary format, and encoded messages are lighter in size. So, messages are exchanged faster, even in machines with a slower CPU, such as mobile devices.
Request and Response Multiplexing - Multiple requests/response in one single connection.

Underlying Concepts#

Protocol Buffers#

aka protobuf . It’s Google’s serialization/deserialization protocol that enables easy definition of services and auto-generation of client libraries. It is an IDL (Interface Definition Language).

How is XSS different from CSRF?

Tue, 28 Jun 2022 00:00:00 +0000

An interesting discussion, led me to realize this is one of the commonly discussed topic and I thought a blog post for it might be helpful for someone.

Cross-site request forgery and Cross-site scripting are both client side attacks which performs action on behalf of users.

Just some context here -

Cross-site scripting (or XSS) allows an attacker to execute arbitrary JavaScript within the browser of a victim user. The attack happen because of the acceptance of the malicious code by the sites.
Cross-site request forgery (or CSRF) allows an attacker to induce a victim user to perform actions that they do not intend to. This attack can be performed by the code hosted on any third party attacker controlled site.

Before diving into the differences, let’s see what conditions needs to be met in order for both the attacks to be successful.

This is why you need a personal Collaborator Client!

Tue, 22 Jun 2021 00:00:00 +0000

If you have used Burp’s collaborator client for your Out-of-band testing, you know it’s awesome. Then why there is a need for a personal collaborator client? There are a few things that need to be addressed.

Companies have started to blacklist burp collaborator’s domain, making it difficult for OOB vulnerabilities detection. (Read here)
Collaborator client is not available for the community/free edition of BurpSuite.

This brings the need for having a personal collaborator client, with no to minimal investments, that will help us in the detection of any out-of-band/blind vulnerabilities, and I have linked an amazing cheatsheet below that will guide in OOB Exploitation. So, let’s get started. Below are the things required for our recipe to cook:

How does burp proxy work?

Mon, 07 Jun 2021 00:00:00 +0000

What’s a proxy?#

A proxy acts as a gateway between you and the internet. The internet traffic flow back and forth if a proxy is setup in the middle. So, what is the need of proxy? There are several reasons organizations and individuals use proxies:

Control and monitor internet usage
Proxy servers can give better speed and bandwidth by caching websites
Proxy servers can also be setup along with VPNs to provide anonymity and better security

There are different types of proxies, but a specific type of proxy that we are going to talk about in this blog is interception proxy.

Bug Bounty Summit CTF Writeup

Mon, 02 Nov 2020 00:00:00 +0000

The CTF is live on Hacker101 as Grayhatcon CTF – Hacker101 CTF

The CTF was built upon real vulnerabilities found during bug bounties. It had four flags – 250 points each.

Objective - Hackerone’s Username and Password database has been leaked and put on an auction. Our task was to delete the auction listing before anyone buys it.

We were given an IP, which resolved to a web application. On performing some basic information gathering, I found out some stuff.