How should web app developers defend against JSON hijacking?
Dec 12, 2016 · If the JSON data contains anything confidential or non-public, host it at a secret unguessable URL (e.g., a URL containing a 128-bit crypto-quality random number), and only …
SQL Injection on POST JSON request - Information Security Stack …
Aug 13, 2018 · Explore related questions sql-injection burp-suite json See similar questions with these tags.
String in JSON message body blocked by Azure WAF with OWASP …
Oct 4, 2022 · I believe these are seen by the WAF as XSS or SQL Injection attacks, but I don't have a way to prove it. So the question is, why are these requests being blocked by a WAF? …
sql injection - Custom post data JSON payload format in sqlmap ...
Mar 5, 2018 · Custom post data JSON payload format in sqlmap? Ask Question Asked 7 years, 9 months ago Modified 2 months ago
sql injection - How to configure SQLMap to attack JSON …
Apr 21, 2021 · How to configure SQLMap to attack JSON parameter? Assumption: There is a POST endpoint that has a parameter named search Copy the RAW HTTP request in a text file …
Is using JSON really enough to fix PHP object insertion?
So I was just reading up on the OWASP site about PHP Object Injection. According to their site, the suggested fix is to not use serialze and unserialize but to use json_encode and …
javascript - XSS in script tags application/json - possible ...
Aug 10, 2020 · Create a new (non-JSON) script tag alert() Close this newly-created script tag Render the leftover "} Discard the leftover </script> Although there are certainly differences …
SQLmap custom injection point in JSON
Jun 21, 2023 · The parameter testid has time-based sql injection issue. I saved this request into post.txt, set testid as the injection point, then tried use SQLmap to extract more information …
Reflected XSS found in web application via POST request with …
I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his …
sql injection - SQLMAP - POST JSON data as body - Information …
SQLMAP - POST JSON data as body Ask Question Asked 9 years ago Modified 9 years ago