Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

All posts

50 posts

All topics

Server-side requests & parsers <!ENTITY lol9 "&lol8;&lol8;&lol8;">

XML External Entity5 min read

Billion Laughs: Denial of Service Through XML Entity Expansion

An XML parser that expands internal entities will happily inflate a few hundred bytes into gigabytes of memory. Here is how the billion-laughs bomb and its quadratic-blowup cousin DoS a server with no network and no external DTD, and the parser limits that stop it.

Client-side & redirects new Image().src='//attacker.example/x'

Cross-Site Scripting5 min read

Blind XSS: When Your Payload Fires in an Admin Panel You Never See

Blind XSS stores a payload that executes later in a context the attacker never sees — an admin dashboard, a log viewer, a support back-office. Here is how it surfaces, why an out-of-band callback is the only way to confirm it, and how the same stored-XSS defenses shut it down.

Files, objects & APIs { user(id: 1043) { email } }

GraphQL5 min read

Broken Object-Level Authorization in GraphQL Resolvers

Authenticating a GraphQL caller is not the same as authorizing them for a specific object. When resolvers trust their id arguments, one logged-in user can read and mutate another user's data. Here is how BOLA reaches through resolver arguments, and how to enforce checks at every object.

InjectionOverview ; id

Command Injection7 min read

Command Injection: How One Semicolon Hands Over Your Server

OS command injection turns a harmless-looking parameter into a shell prompt for an attacker. Here is how shell metacharacters escape into system commands, the blind variants, and the fix that ends it.

Client-side & redirectsOverview Origin: https://evil.example

CORS Misconfiguration3 min read

CORS Misconfiguration: When a Stranger's Website Can Read Your Logged-In Data

An overly permissive CORS policy lets a malicious site read responses meant only for the victim. Here is how reflecting the Origin header goes wrong, and how a strict allowlist fixes it.

InjectionOverview %0d%0aSet-Cookie: session=1

CRLF Injection5 min read

CRLF Injection: How Two Invisible Characters Split an HTTP Response

A carriage return and a line feed are all it takes to inject headers, forge cookies and poison caches. Here is how CRLF injection leads to HTTP response splitting, and how to shut it down.

Client-side & redirectsOverview <script>alert(1)</script>

Cross-Site Scripting3 min read

Cross-Site Scripting, Explained: Reflected, Stored and DOM-Based XSS

Cross-site scripting lets attacker-controlled input run as JavaScript in a victim's browser. Here is what XSS is, how its three variants differ, and the layered defense that shuts all of them down.

Injection 6*7===42

Remote Code Execution5 min read

Eval Injection: When a Runtime Treats User Text as Code

Dynamic evaluators such as eval, new Function and exec turn text into program logic. Learn how the boundary fails, how harmless arithmetic proves it, and how a narrow data model replaces evaluation.

Files, objects & APIsOverview { __schema { types { name } } }

GraphQL4 min read

GraphQL API Security: Introspection, Deep Queries and the Authorization Gap

GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.