Web Security
6 matching posts.
The Service Was Observed. The Application Was Still Unknown.
Passive internet data can reveal a live service without proving its current owner, hostname, virtual host, application, or business purpose. A defensible external pentest turns that observation into a bounded application model before testing for vulnerabilities.
The Page Never Had Permission. The Extension Did.
A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.
The Request Stayed Server-Side. The Credential Did Not.
SSRF severity is not the URL an application can fetch. It is the trust the outbound request inherits — network position, redirect behavior, DNS resolution, and access to metadata or control-plane identities. Test the route as a chain, not a blacklist.
The Signature Is Valid. The Token Still Belongs Somewhere Else.
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
The Flow Is Standard. The Bypass Is in the Half You Skipped.
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
The Path Your Proxy Blocks Is Not the Path Your App Runs
When authorisation and routing are done by different software, they parse the URL differently. The bypass is not in either component — it is in the order they run.