⚠ UNAUTHORIZED FUN DETECTED ⚠

THE
WEB CIRCUS

Welcome to the part of the internet where HTTP requests go to die.

We intercept. We modify. We break.

● SYSTEM COMPROMISED
SCROLL IF YOU DARE

EVERY
REQUEST IS
SUSPICIOUS.

A browser sends a request. A server responds. Simple. Until someone starts changing the request.

Burp Suite
Proxy // HTTP history
Proxy
Repeater
Intruder
HTTP history
GET /profile?id=1337 HTTP/1.1
Host: target.local
User-Agent: Mozilla/5.0
Cookie: session=eyJhbGciOi...
GET /profile?id= 1337



GET /profile?id= 1338

// What happens when we change the parameter?

THE
TOP TEN

The clown has studied the OWASP Top 10. Have you?

A01

Broken Access Control

Users accessing things they shouldn't.

A02

Cryptographic Failures

Sensitive data exposed through weak protection.

A03

Injection

SQL, command and other untrusted input attacks.

A04

Insecure Design

Security problems built into the architecture.

A05

Security Misconfiguration

Defaults, exposed services and bad configuration.

A06

Vulnerable Components

Dependencies with known security weaknesses.

A07

Authentication Failures

Weak authentication, sessions and credentials.

A08

Software Integrity

Untrusted updates, plugins and pipelines.

A09

Logging Failures

Attacks happen while nobody is watching.

A10

SSRF

The server becomes your proxy.

SAY
HELLO
TO XSS.

The browser trusts the application. The application trusts the input. The clown trusts absolutely nobody.

// user input
<script>
alert("HONK");
</script>

// application response

[ EXECUTED ]
THE CLOWN IS IN YOUR BROWSER.
POST /login

username= admin'--
password= anything

HTTP/1.1 200 OK

DATABASE SAID YES.

SQL
INJECTION

Never trust user input. Especially when the user looks like this clown.

SEE YOU
IN THE LOGS.

Learn the vulnerability.
Understand the request.
Fix the damn thing.

INTERCEPT AGAIN →