Welcome to no-sec blog, where a team of passionate Telekom MMS pentesters shares their insights and expertise from the world of cybersecurity. From CVE write-ups to practical guides on exploitation techniques and defense strategies, we aim to contribute valuable knowledge to the security community.

Using Whitelisting to control file access in Apache Webserver

Jun 28, 2016 - Fuseki

You want to control which files on your webserver can be accessed by whom, but you don’t want to use blacklisting. You want to say, i.e., external users can access files whose names end with .php, .jpg and .png. All other files must not be accessible, no matter which name they have.

PHP Exploitation with $REQUEST while validating $GET

May 20, 2016 - SecMyth

while penetration testing and code reviewing a customer’s web-application I came across an interesting bug I’m going to describe in this article. The application in question supports third party plugins which often follow their own coding-conventions.

HTTP Side-Channel Attacks with Burp Suite

Apr 25, 2016 - SecMyth

Ever wanted a simple tool capable of performing a side-channel attackof HTTP requests? A common use case would be to test of the login action takes more time of the provided username is known by the system compared to an unknown username.