Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

All posts

50 posts

All topics

Client-side & redirects <script>alert(document.cookie)</script>

Cross-Site Scripting3 min read

Stored XSS: One Injection, Every Visitor

Stored XSS writes attacker-controlled script into your database and replays it to everyone who views the content. Here is why it outranks reflected XSS, and how output encoding plus HTML sanitization shuts it down.

Injection UNION SELECT NULL,'ssec-lab'

SQL Injection4 min read

UNION-Based SQL Injection: Appending Your Own Result Set

When a vulnerable query's results are rendered, UNION SELECT can append a second compatible result set. Learn the required conditions, a harmless marker proof, and the defenses that keep query structure fixed.

Injection 42 AND 1=1

SQL Injection4 min read

Boolean-Based Blind SQL Injection: Extracting Data One Bit at a Time

When an injectable endpoint displays no database output, it can still answer yes-or-no questions through response differences. Learn how the oracle works, when it is reliable, and how parameterization removes it.

Injection IF(1=1,SLEEP(2),0)

SQL Injection5 min read

Time-Based Blind SQL Injection: Reading a Database Through the Clock

When two responses are byte-for-byte identical, the database can still answer questions — by stalling. Time-based blind SQLi reads data purely from how long a request takes.

InjectionOverview ' OR '1'='1' -- -

SQL Injection6 min read

SQL Injection, Explained: From Login Bypass to Full Data Extraction

SQL injection is still one of the most damaging web vulnerabilities. Here is how it actually works, what an attacker can do with it, and the one fix that reliably stops it.