N4shX's Wiki
NashX's - PentestPal
NashX's - PentestPal
  • WELCOME!
    • Introduction - PentestPal
    • Values & FAQ
    • About the Author
  • METHODOLOGIES & RESOURCES
    • Pentesting Methodology
      • OSINT
    • External Recon Methodology
    • Pentesting Wifi
    • Password Hash Cracking / Bruteforce
      • Password Profiling
      • Offline Attacks
      • Online attacks
      • Spraying attack
      • Wordlists
    • Search Exploits
  • Pentest phases
    • 1. Reconnaissance
      • Methodology
    • 2. Scanning and Enumeration
      • Methodology
    • 3. Exploitation
      • Reverse Shells
        • Listener
        • Shell Upgrade
        • Bash Shells
        • Python Shells
        • PHP Shells
        • PowerShell Shells
        • Reverse Shells - Windows
        • Webpage
      • Payload Types in Metasploit
    • 4. Post-Exploitation
      • KeePass Master Password Extraction via Memory Dump
    • 5. Reporting
  • Linux Hardening
    • Wichtige Linux-Befehle und Dateien für Pentesting
    • Privilege escalation
      • sudo rechte ausnutzen
        • Linux mit GTFOBins
      • SUID-Binaries Exploitation
      • Cronjob Abuse
      • Weak File Permissions
      • Third-Party Binary Abuse
      • Automatisierte Enumeration
        • Linpeas
  • Windows Hardening
    • Wichtige Windows-Befehle und Dateien für Pentesting
    • Privilege escalation
  • NETWORK SERVICES PENTESTING
    • 25 - SMTP
    • 21 - FTP
    • 22 - SSH/SFTP
      • SSH Key Formats and Conversion
    • 21 - Telnet
    • 53 - DNS
    • 80,443 - Web Methodology
    • 139, 445 - SMB
    • 143, 993, 110, 995 - IMAP, POP3
    • 1433 - MSSQL
    • 5432 - PostgreSQL
    • 873 - rsync
    • 2049 - NFS Service
    • 27017 - MongoDB
      • MongoDB Cheatsheet
    • 3306 - MySQL
    • 3389 - RDP
    • 6379 - Redis
  • WEB PENTESTING
    • Fundamentals of Web Pentesting
      • robots.txt Pentesting
      • .well-known Pentesting
      • HTTP/-S Basics
        • HTTP- und HTTPS-Sicherheitsaspekte (z. B. TLS/SSL)
        • HTTP Methoden
      • Cookies
    • Reconnaissance and Discovery
      • Directory and Content Discovery
      • Virtual Hosts Discovery
      • Subdomain Enumeration
      • Public Files and Endpoints
      • Archive and History lookup
        • Wayback Machine
      • Auto Recon
    • Vulnerability Analysis and Attack Vectors
      • Local File Inclusion (LFI) und Remote File Inclusion (RFI)
        • Using LFI/RFI for NTLM Hash Leakage via Responder
      • Authentication Bypass
        • PHP Type Juggling mit strcmp() ausnutzen
      • Broken Access Control (Insecure Direct Object Reference ("IDOR")
      • Bypassing Content Security Policies (CSP)
      • SQL Injection
        • Simple SQL-Injection
      • Cryptographic Failures
      • Cross-Site Scripting (XSS)
        • XSS Fundamentals
      • Cloud Security
        • AWS S3 Bucket
      • XXE Attack
    • References and Cheatsheets
      • SQL Injection Cheatsheet
      • XSS Payloads
      • Directory Traversal Cheatsheet
      • Important HTTP Security Headers (e.g., CSP, HSTS, X-Frame-Options)
    • Tools for Web Application Pentesting
  • Social Engineering
    • Methods and Techniques
      • Phishing
      • Spear Phishing
      • Pretexting
      • Vishing und Smishing
      • Quishing
    • Tools for Social Engineering
    • Psychologische Prinzipien
  • CRYPTO & STEGO
    • Cryptography Analysis Methods
  • HARDWARE/PHYSICAL ACCESS
    • Methods and Techniques
      • USB-basierte Angriffe
      • Side-Channel-Angriffe
      • Cold Boot Attacks
    • Physical Attacks
    • RFID/NFC Attacks
  • Pentesting tools
    • Tool-List
    • Reconnaissance
      • 1. DNS-Reconnaissance
        • Amass
        • dnsenum
        • Sublist3r
        • whois
      • 2. Webbasierte Reconnaissance
        • Shodan
        • Metadaten-Extraktion
        • Webarchiv-Tools
          • waybackurls
          • Wayback Machine (archive.org)
      • 3. Social Media & OSINT
        • datasploit
        • Maltego
        • theHarvester
    • Netzwerk-Scanning & Enumeration
      • Nikto
      • Gobuster
      • Netcat
      • snmpwalk
      • Nmap
        • Nmap Scripting Engine (NSE)
        • Firewall und IDS/IPS Evasion
        • Top 5 for CTF
      • Wireshark
        • Tshark
        • Termshark
      • TCPDUMP
        • Tcpdump Packet Filtering
    • Password attacks
      • Hashid
      • John the Ripper (Jumbo Version)
      • Hashcat
      • Hydra
    • Vulnerability analysis & exploitation
      • Metasploit Framework
      • sqlmap
    • Post-Exploitation Tools
      • Mimikatz
      • BloodHound
    • Web Application Pentesting Tools
      • Burp Suite
      • OWASP ZAP
      • Crypto & Stego Tools
    • Wireless Pentesting Tools
      • Aircrack-ng
      • WiFi Pineapple
    • Social Engineering Tools
    • Hardware/Physical Hacking Tools
      • Proxmark3
      • Lockpicking tools
      • Flipper Zero
  • Fundamentals
    • Number Systems
    • Network Fundamentals
      • Wireshark Paket
        • Networking Primer - Layers 5-7
    • Glossar
      • Malware, Viren etc.
    • Setting Up a Pentesting Environment
      • Default Penian made by N4shX
      • Creating a Pentesting Machine
        • Kali additional Tools
  • Cheatsheet (exkl. Win)
  • Others
    • Archive
      • Erweiterte Nmap-Befehle und Erklärungen
Powered by GitBook
On this page
  1. WEB PENTESTING
  2. Vulnerability Analysis and Attack Vectors

Bypassing Content Security Policies (CSP)

PreviousBroken Access Control (Insecure Direct Object Reference ("IDOR")NextSQL Injection