Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #owasp-top-10

47 posts

All topics Clear tag filter

Injection IF(1=1,SLEEP(2),0)

SQL Injection5 min read

Time-Based Blind SQL Injection: Reading a Database Through the Clock

When two responses are byte-for-byte identical, the database can still answer questions — by stalling. Time-based blind SQLi reads data purely from how long a request takes.

InjectionOverview ' OR '1'='1' -- -

SQL Injection6 min read

SQL Injection, Explained: From Login Bypass to Full Data Extraction

SQL injection is still one of the most damaging web vulnerabilities. Here is how it actually works, what an attacker can do with it, and the one fix that reliably stops it.