// technical blog
How the vulnerabilities we see most in our pentests actually work — and how to defend against them. Written by people who break applications for a living.
A practical guide to security headers: what CSP, HSTS, X-Frame-Options, nosniff and friends protect, how their absence is exploited in a pentest, and the exact config line per stack.
A technical guide to every SSRF bypass — IP representations, allowlist evasion, cloud metadata, exotic protocols, DNS rebinding and parser confusion — with examples and the mechanism behind each one.
The token alphabet soup explained: what JWT, JWS, JWE, JWA and JWK are, how the JOSE framework connects them, and why a JWT is almost always actually a JWS.
How Broken Access Control (OWASP A01) and IDOR let attackers read, change and delete data that belongs to other users — and how centralized, per-object authorization eliminates the flaw.
How poorly validated JWTs lead to authentication bypass: alg none, RS256 to HS256 confusion, crackable weak secrets and unverified claims — and how to validate tokens securely.
How Server-Side Template Injection turns a text field into remote code execution on the server: detection by engine (Jinja2, Twig, Freemarker), exploitation in a pentest and the correct defense.
The complete guide to Cross-Site Scripting: the three types, injection context, blind and mutation XSS, exploitation and modern defense (context encoding, CSP, Trusted Types).
How disagreements between Content-Length and Transfer-Encoding let attackers smuggle requests (CL.TE, TE.CL, TE.TE, HTTP/2 downgrade) — impact, detection and mitigation.
How unkeyed inputs and path confusion weaponize the cache: poisoning served to everyone and deception that leaks authenticated pages — with real detection and defense.
How race conditions let attackers redeem coupons many times, bypass limits and double-spend balance — the single-packet attack and defense with atomicity and locks.
How CAPTCHA actually works, where to place it, the server-side validation almost nobody gets right, its bypasses, and why it is a layer — never the whole defense.
How subtle differences in login, signup and password-reset messages let an attacker discover valid accounts — and how uniform responses, constant time and rate limiting close the oracle.
How SSRF turns your server into the attacker proxy, from stealing cloud metadata credentials to filter bypasses via DNS rebinding and redirects — and the correct defense architecture.
How Cross-Site Request Forgery rides the victim session to perform actions without consent, and how anti-CSRF tokens, SameSite and Origin verification eliminate the flaw.
A deep dive into how clickjacking tricks users with invisible iframe overlays, why JavaScript frame busting fails, and how X-Frame-Options, CSP frame-ancestors and SameSite harden your application.
No articles match your search.
