Posts on web-security
12 posts on web-security. Notes from public sources and my own test lab.
Don't Underestimate __proto__: You Might Lose the Whole Kingdom
How a 'sneaky' JSON key turned a 3 AM incident response into a deep dive into Prototype Pollution and its path to Remote Code Execution.
The Silent Cry of Parameters: Hunting Logic and Architecture in Modern Web Apps
When you multiply the 'amount' parameter in a checkout request by -1 and the server returns a 200 OK, your entire security architecture just became a paper tiger. Let's dive into why logic and architecture hunting is the real frontier of modern security.
Beyond IDOR: Logic Flaws and Invisible Doors in the API World
A deep dive into BOLA (Broken Object Level Authorization) and why modern security is no longer just about firewalls, but about the logic within our endpoints.
Görünmez Duvarları Aşmak: PDF Generator'dan Cloud Metadata'ya Uzanan O Tehlikeli Yol
Bir PDF oluşturma servisinin nasıl bir iç ağ casusuna dönüştüğünü ve bulut ortamındaki en değerli anahtarların nasıl tehlikeye girdiğini teknik bir kriz anıyla inceliyoruz.
JSON’s Backdoor: The Forgotten 'Logic' and Invisible Threats in API Security
Modern security isn't just about blocking scripts; it's about understanding the logic of your APIs. Let's dive into why WAFs aren't enough when your business logic is broken.
The Browser's Dark Alleys: DOM-Based XSS and the 'It Won't Happen to Me' Delusion
We've spent years hardening our servers, but the battlefield has shifted to the client-side. Let's dive into why your modern SPA might be more vulnerable than you think, focusing on the subtle danger of DOM-based XSS.
The Shadow Creeping Behind the Walls: Anatomy of SSRF and Those 'Innocent' Looking Parameters
A deep dive into Server-Side Request Forgery (SSRF), exploring how 'innocent' URL parameters can lead to full cloud environment compromise, shared from the perspective of a Red Team Lead.
The Silent Betrayal of the Cache: Web Cache Poisoning via Unkeyed Headers
Ever wonder how a performance booster like Varnish or Cloudflare could be turned against your users? Let's dive into the world of unkeyed headers and see how a simple X-Forwarded-Host can lead to a full-scale JavaScript injection.
The Silent Danger Hidden Between JSON Packets: API Logic Errors and Mass Assignment
In the modern web, the real danger isn't always a complex script; sometimes it's just an extra field in a JSON packet. Let's explore Mass Assignment and how to secure your APIs.
Unlocking Invisible Doors: IDOR and the Silent Guests at API Backdoors
Ever seen someone else's invoice just by changing a number in the URL? That's IDOR. Let’s look at why this 'old but gold' vulnerability still haunts modern APIs and how we can secure our systems.
WAF Won't Save You: The Illusion Behind Firewalls and the Harsh Truths
Think your 'premium' WAF makes your web application invincible? Think again. Let's talk about why defense starts in the code, not at the perimeter.
What Happens When You Change Just One Digit? The Silent Scream of IDOR
A deep dive into why authorization flaws like IDOR and business logic errors remain the 'invisible' threats that automated scanners often miss, told through real-world Red Team experience.