IntruderLabs
ENPT
Team collaborating on collective security intelligence with community dashboards and vulnerability analysis

// technical blog

Technical blog

How the vulnerabilities we see most in our pentests actually work — and how to defend against them. Written by people who break applications for a living.

All articles

  1. Security headers in practice: what each header protects and how to configure it

  2. SSRF Bypasses: why each filter-evasion technique works

  3. JWT, JWS, JWE, JWA and JWK: the difference between the JOSE acronyms

  4. IDOR and Broken Access Control: how authorization breaks and how to lock it down

  5. JWT vulnerabilities: alg none, algorithm confusion and weak secrets

  6. SSTI: what Server-Side Template Injection is and how it becomes RCE

  7. XSS, the definitive guide: reflected, stored, DOM-based and beyond

  8. HTTP Request Smuggling: desyncing front-end and back-end

  9. Web Cache Poisoning and Web Cache Deception: poisoning and tricking the cache

  10. Race conditions in web apps: TOCTOU, limit-overrun and single-packet

  11. Protecting web forms with CAPTCHA: what it solves and what it does not

  12. User enumeration: when the form message reveals who has an account

  13. SSRF: how Server-Side Request Forgery works and how to contain it

  14. CSRF: how request forgery works and how to harden your forms

  15. Clickjacking: how click hijacking works and how to defend against it

Abstract digital network with orange and blue nodes and connections on a dark background

Need to go further?

We offer a complete white-label offensive security stack with Pentest, Scan and Social Engineering, delivered under your brand with specialist support.

Hire Intruder