Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

All posts

50 posts

All topics

Files, objects & APIs {user{posts{author{posts{id}}}}}

GraphQL4 min read

GraphQL Denial of Service: Deeply Nested and Aliased Queries

GraphQL lets the client decide how much work the server does. Without depth limits, cost analysis and batching caps, a single small request can amplify into enormous server load. Here is how nesting, aliasing and batching turn one query into a denial of service, and how to bound it.

Files, objects & APIs Did you mean "user"?

GraphQL4 min read

GraphQL Introspection: Mapping a Hidden Schema in One Query

Introspection is built into every GraphQL server, and by default it hands any client a complete map of your type system. Here is how a single query dumps every query, mutation and hidden field, how field suggestions leak the schema even when introspection is off, and how to lock it down.

Server-side requests & parsersOverview Host: evil.attacker.com

Host Header Injection3 min read

Host Header Injection: How a Spoofed Header Hijacks Password-Reset Links

Applications that trust the Host header to build absolute URLs can be tricked into emailing attacker-controlled reset links and poisoning caches. Here is how it works and how to validate your way out.

Files, objects & APIsOverview (os.system, ("id",))

Insecure Deserialization3 min read

Insecure Deserialization: How a Serialized Blob Becomes Remote Code Execution

When an application rebuilds objects from untrusted serialized data, attacker-crafted gadget chains can run code during deserialization itself. Here is how object injection leads to RCE, and why data-only formats are the fix.

InjectionOverview *)(uid=*))(|(uid=*

LDAP Injection6 min read

LDAP Injection: When User Input Rewrites a Directory Search

LDAP injection is SQL injection's directory-service cousin. Learn how unescaped assertion values rewrite a search filter, why password checks belong in a bind, and how RFC 4515 encoding closes the boundary.

Files, objects & APIs php://filter/convert.base64-encode

Path Traversal6 min read

LFI vs RFI: From File Disclosure to Remote Code Execution

File inclusion bugs come in two flavors. Local File Inclusion pulls a server-side file into execution — leaking source and secrets, and escalating to code execution through php://filter, log poisoning or /proc/self/environ. Remote File Inclusion pulls in an attacker-hosted URL and runs it outright. The dividing line is include() versus a read-only readfile(), and the fix is to keep user input away from both.

Client-side & redirects <math><mtext><table><mglyph><style>

Cross-Site Scripting6 min read

Mutation XSS (mXSS): How the Browser's Parser Rewrites Your Sanitized HTML

Mutation XSS turns HTML that is inert as a string into executable markup the moment the browser parses and re-serializes it. Here is why an innerHTML round-trip defeats a sanitizer, the parser quirks that cause it, and how to stop re-parsing sanitized output.

InjectionOverview {"$ne": null}

NoSQL Injection6 min read

NoSQL Injection: When JSON Operators Rewrite a Query

Switching from SQL to a document database does not remove injection — it changes the syntax. Learn how attacker-controlled types and operators rewrite filters, and how explicit schemas keep query structure on the server.

Client-side & redirects redirect_uri=app.example.evil.test

Open Redirect4 min read

OAuth redirect_uri Hijacking: Stealing Tokens Through a Loose Redirect

When an OAuth provider validates redirect_uri loosely, the authorization code meant for the real app is delivered to an attacker. Here is how the bypass works and how exact matching, PKCE and state shut it down.