Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

50 deep-dives16 vulnerability topicsFollow via RSS

Find a vulnerability guide

Search by vulnerability, technique, tag, or plain-language symptom.

Start here' OR '1'='1' -- -

Featured guide

SQL Injection6 min read

SQL Injection, Explained: From Login Bypass to Full Data Extraction

SQL injection is still one of the most damaging web vulnerabilities. Here is how it actually works, what an attacker can do with it, and the one fix that reliably stops it.

Read the overview

The library

Browse by attack surface

Browse all 50 posts

Injection

Untrusted input changes the meaning of a query, command or template.

19 posts

SQL Injection8 Command Injection3 NoSQL Injection3 Remote Code Execution2 CRLF Injection1 LDAP Injection1 Server-Side Template Injection1

Client-side & redirects

The victim's own browser and trust boundaries are turned against them.

9 posts

Cross-Site Scripting6 Open Redirect2 CORS Misconfiguration1

Server-side requests & parsers

The server is coerced into fetching or parsing something it shouldn't.

10 posts

SSRF4 XML External Entity4 Host Header Injection2

Files, objects & APIs

Paths, serialized objects and API schemas leak more than intended.

12 posts

Insecure Deserialization5 GraphQL4 Path Traversal3

Recently published

Latest posts

All 50 posts →

<!ENTITY lol9 "&lol8;&lol8;&lol8;">

XML External EntityDenial of Service5 min read

Billion Laughs: Denial of Service Through XML Entity Expansion

An XML parser that expands internal entities will happily inflate a few hundred bytes into gigabytes of memory. Here is how the billion-laughs bomb and its quadratic-blowup cousin DoS a server with no network and no external DTD, and the parser limits that stop it.

SelfSec TeamJun 23, 2026

new Image().src='//attacker.example/x'

Cross-Site ScriptingBlind5 min read

Blind XSS: When Your Payload Fires in an Admin Panel You Never See

Blind XSS stores a payload that executes later in a context the attacker never sees — an admin dashboard, a log viewer, a support back-office. Here is how it surfaces, why an out-of-band callback is the only way to confirm it, and how the same stored-XSS defences shut it down.

SelfSec TeamJun 23, 2026

{ user(id: 1043) { email } }

GraphQLBroken Authorization5 min read

Broken Object-Level Authorization in GraphQL Resolvers

Authenticating a GraphQL caller is not the same as authorizing them for a specific object. When resolvers trust their id arguments, one logged-in user can read and mutate another user's data. Here is how BOLA reaches through resolver arguments, and how to enforce checks at every object.

SelfSec TeamJun 23, 2026

Start here; id

Command Injection7 min read

Command Injection: How One Semicolon Hands Over Your Server

OS command injection turns a harmless-looking parameter into a shell prompt for an attacker. Here is how shell metacharacters escape into system commands, the blind variants, and the fix that ends it.

SelfSec TeamJun 23, 2026

Start hereOrigin: https://evil.example

CORS Misconfiguration3 min read

CORS Misconfiguration: When a Stranger's Website Can Read Your Logged-In Data

An overly permissive CORS policy lets a malicious site read responses meant only for the victim. Here is how reflecting the Origin header goes wrong, and how a strict allowlist fixes it.

SelfSec TeamJun 23, 2026

Start here%0d%0aSet-Cookie: session=1

CRLF Injection5 min read

CRLF Injection: How Two Invisible Characters Split an HTTP Response

A carriage return and a line feed are all it takes to inject headers, forge cookies and poison caches. Here is how CRLF injection leads to HTTP response splitting, and how to shut it down.

SelfSec TeamJun 23, 2026