Welcome to no-sec blog, where a team of passionate Telekom MMS pentesters shares their insights and expertise from the world of cybersecurity. From CVE write-ups to practical guides on exploitation techniques and defense strategies, we aim to contribute valuable knowledge to the security community.

PHP Exploitation with $REQUEST while validating $GET

May 20, 2016 - SecMyth

while penetration testing and code reviewing a customer’s web-application I came across an interesting bug I’m going to describe in this article. The application in question supports third party plugins which often follow their own coding-conventions.

HTTP Side-Channel Attacks with Burp Suite

Apr 25, 2016 - SecMyth

Ever wanted a simple tool capable of performing a side-channel attackof HTTP requests? A common use case would be to test of the login action takes more time of the provided username is known by the system compared to an unknown username.