Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

InjectionOverview ' OR '1'='1' -- -

Featured guide

SQL Injection6 min read

SQL Injection, Explained: From Login Bypass to Full Data Extraction

SQL injection is still one of the most damaging web vulnerabilities. Here is how it actually works, what an attacker can do with it, and the one fix that reliably stops it.

Read the overview

Browse by topic

Browse all 50 posts

Injection

Untrusted input changes the meaning of a query, command or template.

19 posts

Browse 7 topics

Client-side & redirects

The victim's own browser and trust boundaries are turned against them.

9 posts

Browse 3 topics

Server-side requests & parsers

The server is coerced into fetching or parsing something it shouldn't.

10 posts

Browse 3 topics

Files, objects & APIs

Paths, serialized objects and API schemas leak more than intended.

12 posts

Browse 3 topics

Latest posts

All 50 posts

Server-side requests & parsers <!ENTITY lol9 "&lol8;&lol8;&lol8;">

XML External Entity5 min read

Billion Laughs: Denial of Service Through XML Entity Expansion

An XML parser that expands internal entities will happily inflate a few hundred bytes into gigabytes of memory. Here is how the billion-laughs bomb and its quadratic-blowup cousin DoS a server with no network and no external DTD, and the parser limits that stop it.

Client-side & redirects new Image().src='//attacker.example/x'

Cross-Site Scripting5 min read

Blind XSS: When Your Payload Fires in an Admin Panel You Never See

Blind XSS stores a payload that executes later in a context the attacker never sees — an admin dashboard, a log viewer, a support back-office. Here is how it surfaces, why an out-of-band callback is the only way to confirm it, and how the same stored-XSS defenses shut it down.

Files, objects & APIs { user(id: 1043) { email } }

GraphQL5 min read

Broken Object-Level Authorization in GraphQL Resolvers

Authenticating a GraphQL caller is not the same as authorizing them for a specific object. When resolvers trust their id arguments, one logged-in user can read and mutate another user's data. Here is how BOLA reaches through resolver arguments, and how to enforce checks at every object.

InjectionOverview ; id

Command Injection7 min read

Command Injection: How One Semicolon Hands Over Your Server

OS command injection turns a harmless-looking parameter into a shell prompt for an attacker. Here is how shell metacharacters escape into system commands, the blind variants, and the fix that ends it.

Client-side & redirectsOverview Origin: https://evil.example

CORS Misconfiguration3 min read

CORS Misconfiguration: When a Stranger's Website Can Read Your Logged-In Data

An overly permissive CORS policy lets a malicious site read responses meant only for the victim. Here is how reflecting the Origin header goes wrong, and how a strict allowlist fixes it.

InjectionOverview %0d%0aSet-Cookie: session=1

CRLF Injection5 min read

CRLF Injection: How Two Invisible Characters Split an HTTP Response

A carriage return and a line feed are all it takes to inject headers, forge cookies and poison caches. Here is how CRLF injection leads to HTTP response splitting, and how to shut it down.