Results for “data-extension”

Detect and exploit XML External Entity (XXE) injection vulnerabilities in XML parsers, including file disclosure, SSRF, and blind out-of-band exfiltration.

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. Maps to OWASP API3:2023 Broken Object Property Level Authorization.

Guides authorized reverse engineering of Chrome and Firefox browser extensions, covering manifest analysis, background workers, and credential or traffic logic recovery.