[earflaps]

I'm not necessarily asking for the easiest (I.E Sql injection), just the most common you've seen appear when pen testing. Appreciate any responses <3

[Vittlesical]

prolly no-rate limit which is useless jus spamming emails & it can be chained with other vulns and may or may not lead to account takeover + XSS(Cross-site scripting) + and API Vulnerabilities
https://www.vaadata.com/blog/api-penetra...box-tests/
https://academy.tcm-sec.com/p/hacking-apis
i suggest these resources if you want get into APIs Pentesting

[earflaps]

prolly no-rate limit which is useless jus spamming emails & it can be chained with other vulns and may or may not lead to account takeover + XSS(Cross-site scripting) + and API Vulnerabilities
https://www.vaadata.com/blog/api-penetra...box-tests/
https://academy.tcm-sec.com/p/hacking-apis
i suggest these resources if you want get into APIs Pentesting

Is TCM Sec worth buying or are there alternatives? Ty also

[Vittlesical]

prolly no-rate limit which is useless jus spamming emails & it can be chained with other vulns and may or may not lead to account takeover + XSS(Cross-site scripting) + and API Vulnerabilities
https://www.vaadata.com/blog/api-penetra...box-tests/
https://academy.tcm-sec.com/p/hacking-apis
i suggest these resources if you want get into APIs Pentesting

Is TCM Sec worth buying or are there alternatives? Ty also

from personal experience, i say yes theyre worth buying.
no prob<3

[Crockett]

PHP and XSS - 2 of the most flaws I have seen almost everywhere.

[joepa]

Weak passwords.

[buu]

no IP blocking or rate limiting. so they will let you brute force a login page all day long without detecting it nor blocking you.

[ghostpe]

XSS and SQL injec are well known

[Egirl]

I've seen alot of API shit since most API devs are paid like shit so they don't give a fuck to add some security

[earflaps]

I've seen alot of API shit since most API devs are paid like shit so they don't give a fuck to add some security

Appreciate it lmaoo