SSRF Exploitation: From URL Parameters to Internal Probing
How to find server-side request forgery, confirm it with out-of-band callbacks, and safely map internal services.
SECURITY RESEARCH · blog.arok.win
paradise's Security Notes
Web security, penetration testing, cloud security, and offensive-defense research across the past three years.
All Posts
20 articlesSensitive Information Leak Hunting: Git, Backups, and Configs
Finding exposed version control data, backup archives, editor artifacts, and configuration files before they become a breach.
Subdomain Takeover: Detection, Validation, and Prevention
How stale CNAME records become takeover candidates, how to validate them safely, and how to prevent the problem.
SQL Injection and WAF Bypass: Common Techniques
How to understand WAF normalization, use comments and encodings, and verify that a bypass is actually exploitable.
Honeypots and Deception: Recognizing the Bait
How port, banner, and interaction anomalies reveal deceptive services before an attacker commits real tools or credentials.
Supply Chain Attack Surface: Dependencies, Images, and SDKs
How package managers, CI pipelines, containers, and third-party SDKs expand the attack surface beyond first-party code.
Mobile Traffic Capture and Certificate Pinning Bypass
A workflow for proxying mobile apps, installing a CA, inspecting HTTPS traffic, and bypassing certificate pinning.
API Security Testing: A Practical Checklist
Authentication, object-level authorization, input handling, rate limits, debug endpoints, and logging for modern APIs.
Zero Trust and Least Privilege: An Incremental Migration
How to move from implicit network trust to continuous identity verification, microsegmentation, and least-privilege access.
Access Log Forensics: Reconstructing an Attack Chain
Using time windows, path sequences, user agents, and outbound connections to reconstruct how an attacker entered a system.
Access Control Testing: Horizontal and Vertical Privilege Escalation
A practical guide to finding object-level and role-level authorization flaws without relying on HTTP status codes alone.
Red Team OPSEC: Reducing Footprint and Staying Disciplined
Operational security practices for traffic, timing, credentials, tooling, and communication during adversary simulations.
From XSS to Session Hijack: A Complete Exploitation Chain
How stored cross-site scripting becomes cookie theft, account actions, and persistent access, plus the defenses that break the chain.
Web Reconnaissance: A Practical Methodology
A repeatable process for collecting domains, subdomains, IP ranges, fingerprints, and content paths before any exploit attempt.
JWT Security: Signature Bypasses and Hardening
Common JSON Web Token failures including algorithm confusion, weak keys, header injection, and the defenses that prevent them.
AI-Assisted Vulnerability Hunting: Prompts, Validation, and Limits
Where language models add real value in code review and log analysis, how to prompt them, and why every result needs human validation.
Internal Network Pivoting: Port Forwarding and Proxy Chains
Choosing and operating local forwards, SOCKS tunnels, and reverse proxies in constrained internal environments.
From Response Headers to Behavior: Identifying a WAF
How to determine whether a web application sits behind a WAF by combining headers, block pages, timing, and request mutations.
Cloud Privilege Escalation: From Metadata to Misconfiguration
How instance metadata, role credentials, and permissive policies become escalation paths in cloud environments.
CORS Misconfiguration: Cross-Origin Exploitation and Correct Design
How reflected origins, wildcard credentials, null origins, and subdomain trust can be abused to read cross-origin responses.