Web-Security on Njeru Mtwaiti

Fintech API Security: The Attack Surfaces Nobody Talks About

Tue, 12 Aug 2025 00:00:00 +0000

Working in fintech security — both building payment infrastructure at Durrafx and testing external platforms through bug bounty — has given me a particular view of how fintech APIs fail. The standard OWASP Top 10 checklist catches the obvious stuff. This post is about what comes after that.

Why Fintech APIs Are Different Link to heading

A generic web app leaking user data is bad. A payment API leaking transaction data, processing unauthorized disbursements, or allowing account takeover is directly money-out-the-door bad. The stakes mean that subtle logic flaws — the kind that don’t trigger a WAF, don’t show up in automated scans, and require understanding the business model — are often the most valuable findings.

Web Recon Methodology: How I Map an Attack Surface

Fri, 20 Jun 2025 00:00:00 +0000

Reconnaissance is where engagements are won or lost. The best exploit in the world is useless if you aimed it at the wrong target. This post breaks down my web recon process — what I run, in what order, and what I’m actually looking for.

Philosophy First Link to heading

Recon is not about running every tool you have. It’s about building an accurate mental model of the target:

sqli-hunter

Thu, 15 May 2025 00:00:00 +0000

A purpose-built SQL injection detection and exploitation tool designed for web application pentesting engagements. Lighter and more scriptable than sqlmap for targeted assessments.

Capabilities:

Error-based injection detection across common databases (MySQL, PostgreSQL, MSSQL, SQLite)
Boolean-based blind injection with binary search
Time-based blind injection with adaptive delay tuning
Cookie, header, and POST body injection points
Simple CLI interface for quick integration into recon pipelines

Tech: Python, requests, argparse

Intended for authorized security testing only.

SQL Injection from Zero to Shell: A Practical Walkthrough

Mon, 10 Feb 2025 00:00:00 +0000

SQL injection is one of the oldest and most consistently exploited vulnerability classes on the web. It’s been in the OWASP Top 10 since 2003. It keeps showing up in real engagements, bug bounty reports, and CTF challenges year after year.

This post walks through SQL injection end-to-end — detection, manual exploitation, data extraction, and in some cases, a path to remote code execution.

How It Works Link to heading

When a web application constructs a SQL query by directly embedding user input, an attacker can manipulate that query’s logic.