Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

All posts

50 posts

All topics

Client-side & redirectsOverview returnUrl=https://evil.test

Open Redirect3 min read

Open Redirect: How Your Trusted Link Sends Users to an Attacker

An open redirect lets an attacker borrow your domain's credibility to bounce victims to phishing pages and steal OAuth tokens. Here is how the unvalidated redirect parameter is abused and how to constrain it.

Files, objects & APIsOverview ../../../etc/passwd

Path Traversal3 min read

Path Traversal: How ../ Reads Files You Never Meant to Share

Path traversal lets an attacker climb out of an intended directory with dot-dot-slash sequences and read arbitrary files on the server. Here is how it works, the encodings that defeat naive filters, and the canonicalization fix that stops it.

Files, objects & APIs O:4:"User":1:{s:4:"name";...}

Insecure Deserialization5 min read

PHP Object Injection: unserialize() and the Magic-Method Chain

Calling unserialize() on attacker-controlled input instantiates arbitrary classes and fires their magic methods automatically. Here is how a POP gadget chain rides __wakeup and __destruct to a dangerous sink, and why json_decode is the fix.

Server-side requests & parsers gopher://127.0.0.1:6379/_

SSRF5 min read

Protocol Smuggling in SSRF: gopher, dict and file Schemes

When an SSRF fetcher accepts non-HTTP schemes, the attack stops being about reaching internal HTTP and starts being about speaking arbitrary protocols. gopher:// crafts raw TCP bytes to reach Redis or SMTP, dict:// probes services, and file:// reads local files. Here is how the smuggling works and how a strict scheme allowlist stops it.

Files, objects & APIs !!python/object/apply:os.system

Insecure Deserialization4 min read

Python Deserialization: pickle, PyYAML and the reduce Trap

pickle.loads on untrusted bytes runs code because __reduce__ returns a callable that executes at load time, and yaml.load without SafeLoader builds arbitrary objects. Here is the minimal exploit, and why safe_load and JSON are the fix.

Client-side & redirects <script>alert(document.domain)</script>

Cross-Site Scripting3 min read

Reflected XSS: How a URL Can Run Code in Someone Else's Browser

Cross-site scripting turns a trusted page into a delivery vehicle for attacker-controlled JavaScript. Here is how reflected XSS works, what it can steal, and how output encoding stops it.

InjectionOverview __import__('os').popen('id')

Remote Code Execution6 min read

Remote Code Execution: When User Input Becomes Server Code

Remote code execution is the worst outcome a web bug can produce. Here is how attacker-controlled input reaches an execution sink, the common vectors that get there, and how to close them.

InjectionOverview {{7*7}}

Server-Side Template Injection6 min read

Server-Side Template Injection: From {{7*7}} to Remote Code Execution

When user input is stitched into a server-side template, the template engine becomes an interpreter for the attacker. Here is how a harmless-looking arithmetic probe escalates to full server compromise, and how to design the bug out entirely.

Server-side requests & parsersOverview http://10.0.0.5:8080/admin

SSRF3 min read

SSRF, Explained: When Your Server Becomes the Attacker's Proxy

Server-side request forgery turns a trusted server into a request-making proxy for the attacker, reaching internal services and cloud credentials the internet should never touch. Here is how it works and how to lock it down.