Browsing Tag
linux
297 posts
CSP Bypass: Turning a Security Header Against Itself
The Content Security Policy (CSP) is a special HTTP response header designed to mitigate certain classes of client-side…
Client-Side Template Injection (CSTI): Exploiting Modern Frontend Frameworks
Front-end development has undergone rapid transformation over the past decade. Most modern web applications are built using JavaScript…
Prototype Pollution: Poisoning the JavaScript Object Chain
Introduction JavaScript is fundamentally a prototype-based language. This means that objects do not inherit features from classes (like…
On-Site Request Forgery (OSRF): A Forgotten Client-Side Attack
Introduction On-Site Request Forgery (OSRF) is an older vulnerability that often goes unrecognized. It is similar to Cross-Site…
Server-Side Template Injection (SSTI): Exploiting the Backend View
Introduction To understand Server-Side Template Injection (SSTI), one must first grasp the role of templates, and to understand…
Web Cache Poisoning: Turning Low-Impact Flaws into High-Severity Attacks
Introduction Web cache poisoning is a sophisticated technique attackers use to force caching servers to store and serve…
API Documentation: A Hacker’s Goldmine for Vulnerability Hunting
Introduction The vast majority of vulnerabilities found in Application Programming Interfaces (APIs) are the result of a design…
Understanding and Defending Against SAML Vulnerabilities
Introduction to Security Assertion Markup Language (SAML) If you are currently working with a Fortune 500 company, a…
Authentication Flaws: Compromising User Identity
If an application requires you to log in, it must use some form of authentication to verify who…
API Hacking: Navigating the Modern Application Landscape
The architecture of today’s applications is vastly different from the past. Back in the day, applications were often…