A closer look
at the web.
A personal blog on web application security — finding and reproducing real vulnerabilities, with hands-on proof-of-concepts and exploitation walkthroughs.
Inside the notebook
Web Cache Poisoning: Turning a Cache Into a Weapon
Unkeyed inputs let an attacker store a malicious response in a shared cache and serve it to every visitor. We cover cache keys, unkeyed headers, and deception.
Web Cache Deception: Tricking the CDN Into Storing Private Pages
A path-confusion trick makes a CDN cache a victim's authenticated response under a static-looking URL the attacker can fetch. We cover the delimiter and extension probes and a working data-theft PoC.
CRLF Injection: Splitting Responses and Forging Headers
An unescaped carriage-return/line-feed in a header value lets an attacker inject headers, set cookies, and split the HTTP response. We cover encoding probes and a header-injection PoC.
Cross-Site WebSocket Hijacking: When the Handshake Skips CSRF
A WebSocket handshake authenticated only by cookies and lacking origin checks lets an attacker page open an authenticated socket and read or send messages as the victim. We cover detection and a working CSWSH PoC.
CORS Misconfiguration: The Reflected-Origin Trap
A permissive CORS policy can hand attacker sites read access to authenticated responses. We dissect the reflected-origin and null-origin mistakes.