Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

All posts

50 posts

All topics

Server-side requests & parsers http://169.254.169.254/

SSRF5 min read

Cloud-Metadata SSRF: From One URL to Full Account Takeover

On a cloud host, a single server-side request forgery aimed at the link-local metadata endpoint can hand an attacker temporary cloud credentials. Here is how the IMDSv1, GCP and Azure variants work, and how to shut the door.

Client-side & redirects #<img src=x onerror=alert(1)>

Cross-Site Scripting4 min read

DOM-Based XSS: When the Vulnerability Never Touches the Server

DOM-based XSS lives entirely in client-side JavaScript: an attacker-controlled source flows into a dangerous sink with no server round-trip. Here is why WAFs miss it, and how safe sinks and Trusted Types stop it.

Injection CAST('ssec-lab' AS integer)

SQL Injection4 min read

Error-Based SQL Injection: Turning Database Errors Into Data

A verbose database error is not just a stack trace — it is an output channel. Error-based SQLi tricks the database into printing the data you want inside its own error message.

Files, objects & APIs rO0ABXNyABZqYXZhLnV0aWw

Insecure Deserialization4 min read

Java Deserialization: ObjectInputStream and the Gadget-Chain Problem

Calling ObjectInputStream.readObject() on bytes an attacker controls is enough to reach Runtime.exec during deserialization itself. Here is why a gadget chain runs even though your code never expected that type, and how look-ahead filtering shuts it down.

Injection 0||6*7===42

NoSQL Injection4 min read

MongoDB JavaScript Injection: Why $where Must Stay Server-Owned

MongoDB can evaluate JavaScript in legacy query features such as $where. Learn how string construction crosses into code, how to prove it harmlessly, and why MongoDB 8.0 deprecation strengthens the case for removal.

Injection sku[$ne]=

NoSQL Injection4 min read

NoSQL Operator Injection: When a Scalar Field Becomes a Filter

When a parser turns a scalar field into an object, keys such as $ne, $gt and $regex can become MongoDB query logic. Learn both request shapes, a safe proof, and strict schema defenses.

Injection xp_dirtree '\\ssec-lab.assessment.example\x'

SQL Injection5 min read

Out-of-Band SQL Injection: Confirming a Blind Flaw Through DNS

When a response offers no usable signal, a database-initiated DNS or HTTP callback can confirm SQL execution out of band. Learn the prerequisites, safe correlation model, and layered defenses.

Injection quarterly' OR '1'='1' -- -

SQL Injection4 min read

Second-Order SQL Injection: When Stored Input Detonates Later

Some payloads do nothing at the point of entry. They are stored safely, then read back into a second query that builds SQL by concatenation — and that is where they fire.

Injection 1; WAITFOR DELAY '0:0:2' --

SQL Injection4 min read

Stacked Queries: Running Multiple Statements Through One Injection

Stacked-query injection terminates the intended statement and appends another one. Learn why driver protocol and privileges matter, how a harmless delay proves batching, and how to prevent it.