Browsing Category
Books
65 posts
Detecting and Preventing Injection Attacks: A Deep Dive into SQL, NoSQL, and Scanners
Code injection represents a critical class of security vulnerability where unvalidated data is added (injected) into a vulnerable…
A Quick Overview of Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) stands as a prevalent and dangerous vulnerability in web applications. It occurs when a malicious…
Relative Path Overwrite (RPO): Exploiting Path Confusion for Defacement
Introduction Relative Path Overwrite (RPO) is an older, lesser-known vulnerability that still impacts a significant number of applications.…
CSP Bypass: Turning a Security Header Against Itself
Introduction The Content Security Policy (CSP) is a special HTTP response header designed to mitigate certain classes of…
Client-Side Template Injection (CSTI): Exploiting Modern Frontend Frameworks
Introduction Front-end development has undergone rapid transformation over the past decade. Most modern web applications are built using…
Prototype Pollution: Poisoning the JavaScript Object Chain
Introduction JavaScript is fundamentally a prototype-based language. This means that objects do not inherit features from classes (like…
On-Site Request Forgery (OSRF): A Forgotten Client-Side Attack
Introduction On-Site Request Forgery (OSRF) is an older vulnerability that often goes unrecognized. It is similar to Cross-Site…
Server-Side Template Injection (SSTI): Exploiting the Backend View
Introduction To understand Server-Side Template Injection (SSTI), one must first grasp the role of templates, and to understand…
Web Cache Deception: Tricking the Caching Server to Expose Private Data
Introduction Like web cache poisoning, Web Cache Deception (WCD) is an attack directed against the caching server. The…
Web Cache Poisoning: Turning Low-Impact Flaws into High-Severity Attacks
Introduction Web cache poisoning is a sophisticated technique attackers use to force caching servers to store and serve…