Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #owasp-top-10

47 posts

All topics Clear tag filter

Files, objects & APIsOverview ../../../etc/passwd

Path Traversal3 min read

Path Traversal: How ../ Reads Files You Never Meant to Share

Path traversal lets an attacker climb out of an intended directory with dot-dot-slash sequences and read arbitrary files on the server. Here is how it works, the encodings that defeat naive filters, and the canonicalization fix that stops it.

Files, objects & APIs O:4:"User":1:{s:4:"name";...}

Insecure Deserialization5 min read

PHP Object Injection: unserialize() and the Magic-Method Chain

Calling unserialize() on attacker-controlled input instantiates arbitrary classes and fires their magic methods automatically. Here is how a POP gadget chain rides __wakeup and __destruct to a dangerous sink, and why json_decode is the fix.

Server-side requests & parsers gopher://127.0.0.1:6379/_

SSRF5 min read

Protocol Smuggling in SSRF: gopher, dict and file Schemes

When an SSRF fetcher accepts non-HTTP schemes, the attack stops being about reaching internal HTTP and starts being about speaking arbitrary protocols. gopher:// crafts raw TCP bytes to reach Redis or SMTP, dict:// probes services, and file:// reads local files. Here is how the smuggling works and how a strict scheme allowlist stops it.

Files, objects & APIs !!python/object/apply:os.system

Insecure Deserialization4 min read

Python Deserialization: pickle, PyYAML and the reduce Trap

pickle.loads on untrusted bytes runs code because __reduce__ returns a callable that executes at load time, and yaml.load without SafeLoader builds arbitrary objects. Here is the minimal exploit, and why safe_load and JSON are the fix.

Client-side & redirects <script>alert(document.domain)</script>

Cross-Site Scripting3 min read

Reflected XSS: How a URL Can Run Code in Someone Else's Browser

Cross-site scripting turns a trusted page into a delivery vehicle for attacker-controlled JavaScript. Here is how reflected XSS works, what it can steal, and how output encoding stops it.

InjectionOverview __import__('os').popen('id')

Remote Code Execution6 min read

Remote Code Execution: When User Input Becomes Server Code

Remote code execution is the worst outcome a web bug can produce. Here is how attacker-controlled input reaches an execution sink, the common vectors that get there, and how to close them.

InjectionOverview {{7*7}}

Server-Side Template Injection6 min read

Server-Side Template Injection: From {{7*7}} to Remote Code Execution

When user input is stitched into a server-side template, the template engine becomes an interpreter for the attacker. Here is how a harmless-looking arithmetic probe escalates to full server compromise, and how to design the bug out entirely.

Server-side requests & parsersOverview http://10.0.0.5:8080/admin

SSRF3 min read

SSRF, Explained: When Your Server Becomes the Attacker's Proxy

Server-side request forgery turns a trusted server into a request-making proxy for the attacker, reaching internal services and cloud credentials the internet should never touch. Here is how it works and how to lock it down.

Server-side requests & parsers X-Forwarded-Host: evil.attacker.com

Host Header Injection5 min read

Web Cache Poisoning via the Host Header

When a cache stores a response built from an unkeyed Host header, one attacker request can rewrite what every later visitor receives. Here is how unkeyed input becomes a stored attack and how to key, strip or stop reflecting it.