Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #owasp-top-10

47 posts

All topics Clear tag filter

Injection CAST('ssec-lab' AS integer)

SQL Injection4 min read

Error-Based SQL Injection: Turning Database Errors Into Data

A verbose database error is not just a stack trace — it is an output channel. Error-based SQLi tricks the database into printing the data you want inside its own error message.

Files, objects & APIs rO0ABXNyABZqYXZhLnV0aWw

Insecure Deserialization4 min read

Java Deserialization: ObjectInputStream and the Gadget-Chain Problem

Calling ObjectInputStream.readObject() on bytes an attacker controls is enough to reach Runtime.exec during deserialization itself. Here is why a gadget chain runs even though your code never expected that type, and how look-ahead filtering shuts it down.

Injection sku[$ne]=

NoSQL Injection4 min read

NoSQL Operator Injection: When a Scalar Field Becomes a Filter

When a parser turns a scalar field into an object, keys such as $ne, $gt and $regex can become MongoDB query logic. Learn both request shapes, a safe proof, and strict schema defenses.

Injection xp_dirtree '\\ssec-lab.assessment.example\x'

SQL Injection5 min read

Out-of-Band SQL Injection: Confirming a Blind Flaw Through DNS

When a response offers no usable signal, a database-initiated DNS or HTTP callback can confirm SQL execution out of band. Learn the prerequisites, safe correlation model, and layered defenses.

Injection quarterly' OR '1'='1' -- -

SQL Injection4 min read

Second-Order SQL Injection: When Stored Input Detonates Later

Some payloads do nothing at the point of entry. They are stored safely, then read back into a second query that builds SQL by concatenation — and that is where they fire.

Injection 1; WAITFOR DELAY '0:0:2' --

SQL Injection4 min read

Stacked Queries: Running Multiple Statements Through One Injection

Stacked-query injection terminates the intended statement and appends another one. Learn why driver protocol and privileges matter, how a harmless delay proves batching, and how to prevent it.

Client-side & redirects <script>alert(document.cookie)</script>

Cross-Site Scripting3 min read

Stored XSS: One Injection, Every Visitor

Stored XSS writes attacker-controlled script into your database and replays it to everyone who views the content. Here is why it outranks reflected XSS, and how output encoding plus HTML sanitization shuts it down.

Injection UNION SELECT NULL,'ssec-lab'

SQL Injection4 min read

UNION-Based SQL Injection: Appending Your Own Result Set

When a vulnerable query's results are rendered, UNION SELECT can append a second compatible result set. Learn the required conditions, a harmless marker proof, and the defenses that keep query structure fixed.

Injection 42 AND 1=1

SQL Injection4 min read

Boolean-Based Blind SQL Injection: Extracting Data One Bit at a Time

When an injectable endpoint displays no database output, it can still answer yes-or-no questions through response differences. Learn how the oracle works, when it is reliable, and how parameterization removes it.