Web application security
Routing, OAuth, token verification, and the difference between technically valid input and an authorized action.
Start here, then go deeper.
Move from URL handling to identity claims and business authorization decisions.
- 01RoutingThe Path Your Proxy Blocks Is Not the Path Your App Runs7 min ↗
When authorisation and routing are done by different software, they parse the URL differently. The bypass is not in either component — it is in the order they run.
- 02WebThe Flow Is Standard. The Bypass Is in the Half You Skipped.8 min ↗
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
- 03Token policyThe Signature Is Valid. The Token Still Belongs Somewhere Else.8 min ↗
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 6
The Service Was Observed. The Application Was Still Unknown.
Passive internet data can reveal a live service without proving its current owner, hostname, virtual host, application, or business purpose. A defensible external pentest turns that observation into a bounded application model before testing for vulnerabilities.
16 min read ↗Vulnerability Research · Aug 31, 2026The Page Never Had Permission. The Extension Did.
A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.
21 min read ↗Web Security · Jan 29, 2026The Request Stayed Server-Side. The Credential Did Not.
SSRF severity is not the URL an application can fetch. It is the trust the outbound request inherits — network position, redirect behavior, DNS resolution, and access to metadata or control-plane identities. Test the route as a chain, not a blacklist.
9 min read ↗Web Security · Oct 23, 2025The Signature Is Valid. The Token Still Belongs Somewhere Else.
JWT verification fails when applications treat one cryptographic success as a complete access decision. Algorithm, key, issuer, audience, and token type are separate bindings — skip one and a perfectly valid token crosses the wrong boundary.
8 min read ↗Web Security · May 29, 2025The Flow Is Standard. The Bypass Is in the Half You Skipped.
OAuth 2.0 and OIDC vulnerabilities are almost never in the specification. They are in the parts implementations leave out — state, PKCE, exact redirect matching, audience validation — and the flow runs perfectly while each omission sits there waiting.
8 min read ↗Web Security · Jan 16, 2025The Path Your Proxy Blocks Is Not the Path Your App Runs
When authorisation and routing are done by different software, they parse the URL differently. The bypass is not in either component — it is in the order they run.
7 min read ↗CVE research 3
CVE-2025-31205: How a Detached Stylesheet Exposed Cross-Origin Data
A reader-first analysis of CVE-2025-31205: how JavaScript kept a cross-origin stylesheet alive after detachment, why WebKit treated missing ownership as permission, and how the fix fails closed.
10 min read ↗CVE-2025-24201 · Static ReproductionCVE-2025-24201: How Web Content Reached an Unneeded GPU State
A reader-first reconstruction of Apple's CVE-2025-24201 WebKit fix: what the sandbox-escape advisory says, what primitive restart means, and what the public patch proves without inventing the private exploit chain.
9 min read ↗CVE-2024-4577 · CVE-2024-8926 · Static ReproductionCVE-2024-4577: How Windows Reopened PHP-CGI Command Injection
A reader-first variant analysis of CVE-2024-4577 and CVE-2024-8926: how Windows character conversion turned safe-looking query input into PHP-CGI options and why the first fix needed a follow-up.
10 min read ↗