Research
From Twig and ERB to Jinja2, templates are an essential for modern web development. This week we'll uncover the intricacies of Server-Side Template Injection as we explore what it is, how to identify it, common protection methods, and even examine a Python sandbox escape to bypass those protection!
Research
Even if it doesn’t get a billion LOLs, this week’s article dives into a real classic. XML External Entity attacks are a historic vulnerability that continue to impact modern applications. We’ll be covering how to identify them in the wild, common protections, and even bypasses to said protections!
Research
Howdy hackers! This week we'll be examining Server-Side Request Forgery (SSRF). From what it is, to modern prevention mechanisms, we’ll expand our understanding and develop a methodology on how to test for it in the wild.
Research
Whether you call it “Ess-Cue-Ell”, “Sequel”, or “Squeal”, this week we'll dive into the complexities of SQL Injection. We'll talk about what the vulnerability is and why finding it is such a critical vulnerability, as well as the reasons behind its decline in popularity over recent years.
Research
In this week's article we'll explore the web vulnerability, Cross-Site Request Forgery, more commonly referred to as CSRF (pronounced "Sea Surf"). We'll cover what the vulnerability is and why it matters, as well as common prevention methods and bypasses to these defenses!
Research
In this week's article I deep-dive into how to find Open Redirects in modern web applications, how to manipulate them to bypass validation checks, and briefly touch on the difficulties in preventing them.