web security

9 posts tagged with web security.

2026-07-23bug bountypentestingweb security4 min read

Why I ask for two accounts per role

Finding an IDOR with one account is the easy half. Confirming it is where one account falls apart. Two accounts at the same level turn an identifier you cannot explain into user A retrieved user B's invoice.

2026-06-04web securityCVEWAF11 min read

CrowdSec AppSec WAF bypass via chunked transfer encoding (CVE-2026-44982)

CVE-2026-44982 was a single-header WAF bypass in the CrowdSec AppSec component. Same payload, Content-Length blocked, Transfer-Encoding: chunked passed through to the backend. The root cause was one line in pkg/appsec/request.go. The same shape shipped in an official CrowdSec bouncer and the main third-party Traefik integration, both addressed in subsequent releases without CVE assignment.

2026-04-27bug bountyreconweb security7 min read

The first thirty minutes on a new API

The JavaScript bundle gave you the frontend's idea of the API. The six steps below give you the backend's reality. Version probing, method expansion, parameter discovery, auth boundary checks, response signal.

2026-04-21bug bountyweb securityrecon7 min read

The first ten minutes on a new JavaScript bundle

Opening a stranger's bundled JavaScript for the first time. What I grep for, in what order and why. A practical follow-up to why you should not skip JS files at all.

2026-02-26bug bountyweb securityrecon4 min read

Stop skipping JavaScript files

Running automated scans while ignoring JavaScript files means missing the real gold. Here's how reading JS files led to full admin access on a HackerOne target.

2026-02-18CVEweb securitySQLi3 min read

Two lines of defense that opened the door to SQL injection

Both lines were written for security. One added protection, the other removed it. How $wpdb->prepare() and stripslashes() combined into a critical SQL injection.

2026-01-12bug bountyweb securitySSRF4 min read

DNS rebinding: turning blocked SSRF into internal access

How a well-timed DNS change can bypass SSRF filters and turn a blocked vulnerability into full internal network access.

2025-11-26bug bountypentestingweb security2 min read

The uppercase letter that bypassed authorization

Sometimes a single case change in a URL path is enough to bypass 401/403 errors. Here's why this edge case works and when to test for it.

2025-01-14bug bountyweb securitySQLi3 min read

The single quote that leaked database credentials

One character in a URL parameter exposed full database credentials and turned into a $2,000 double critical finding. Here's what happened.