Filename injection and a four-step privilege escalation: two RCTF web challenges
A filename-based SQL injection bypassing keyword filters, plus a four-stage privilege escalation chain ending in a filtered file upload.
Read moreWeb security
Web application flaws and browser behaviour: XSS, upload bypasses, logic bugs and protocol issues.
2015
When Baidu's traffic was hijacked to flood GitHub
How a March 2015 network-level hijack turned Baidu analytics traffic into an unwitting denial-of-service tool against GitHub.
Read more2014
CySCA 2014: four web challenges from an Australian student CTF
Four 2014 CySCA web challenges, covering trust-the-client access control, markdown XSS, CSRF-protected SQL injection, and hash length extension.
Read moreAutomatically finding XSS inside Flash files
A dynamic testing approach that loads Flash files in a scriptable headless browser and watches for JavaScript execution to flag XSS.
Read moreWhat a QQ group data lookup tool reveals about aggregation risk
An old lookup tool for QQ group membership data illustrates how aggregating many small public details can create a privacy exposure no single data point suggests on its own.
Read more2013
WordPress brute-force attacks: how they work and how to stop them
A look at how attackers enumerate WordPress usernames and brute-force logins, and the defences that stop it: rate limiting, disabling XML-RPC multicall, and two-factor authentication.
Read moreWhy an exposed Tomcat AJP connector is a firewall bypass waiting to happen
Tomcat's AJP connector on port 8009 trusts whoever connects to it; firewalling off the usual HTTP port while leaving AJP reachable quietly defeats the protection entirely.
Read moreWhen a VPN silently falls back to plaintext under interference
If the negotiation traffic an IPSec/L2TP VPN needs to agree encryption is blocked, some clients fall back to an unencrypted tunnel instead of refusing to connect at all.
Read moreWhat a multi-threaded network scanner actually does, conceptually
A conceptual walkthrough of how ping sweeps, threaded port scanning and service fingerprinting combine into a network reconnaissance workflow, and why it requires explicit authorisation.
Read moreThe internal network scanner idea behind a PHP intranet tool
An old PHP scanning and credential-guessing concept, built to run from inside a compromised web host, illustrates internal-network risk after a breach.
Read moreCVE-2013-1464: XSS in the WordPress Audio Player plugin's SWF
CVE-2013-1464: an unsanitised flashvar in the Audio Player WordPress plugin's bundled SWF allowed script execution in the page context.
Read moreCVE-2013-1463: XSS in WP-Table Reloaded's zeroclipboard SWF
CVE-2013-1463: the zeroclipboard SWF shipped with WP-Table Reloaded passed an unsanitised id parameter into an ActionScript call, enabling script injection.
Read moreBrowser security notes: why URL parsing quirks matter
A brief look at why browsers and backends disagreeing on how to parse the same URL is still a quiet source of security bugs.
Read more2012
Attack and defence in web games: a structured overview
A tour of the recurring weak points in browser-based games: tamperable network protocols, memory edits, save-file edits, and account or payment fraud.
Read moreClassic character and filter bypass patterns in cross-site scripting
Overview of how testers historically got around single-character filtering and browser XSS filters, and what it taught defenders about input handling.
Read moreHow a PHP escaping feature undermined a browser XSS filter
How an old PHP input-escaping feature changed request content in a way a browser's XSS filter did not account for, allowing a bypass.
Read moreCVE-2012-0053: a quiet reminder that httponly is not absolute
Apache's handling of oversized headers once echoed full cookie values back in an error page, defeating the httponly flag that was meant to hide them from scripts.
Read moreWhen a bundled upload component ships without its own checks
A reported flaw in a CMS's upload component showed how outsourcing an upload widget's front end can leave its backend endpoint unchecked.
Read moreHow an oversized-cookie error page turned into an httponly bypass
Exploiting the Apache cookie-disclosure flaw needed a second weaker XSS, not a direct document.cookie read, to push the cookie jar over the server's size limit.
Read more2011
A login check that ran the page anyway
A large web portal's admin backend sent a login redirect but never stopped executing, so blocking the redirect client-side exposed the page anyway.
Read moreWordPress theme path disclosure through PHP error messages
Leaving PHP error display on let a WordPress site leak its full server directory path whenever a theme file threw a warning.
Read moreA framework for thinking about file upload attack classes
A conceptual breakdown of how file-upload vulnerabilities tend to be grouped, and the layered defences that address each class.
Read more