The UnboundCompute blog
How web apps and APIs really break.
Clear, honest writing on web and API security. The common bugs, the ones automated scanners miss, and how a real finding is actually proven. Written for everyone from beginners to security teams.
What we write about
Vulnerability Basics
Plain explanations of how software actually breaks.
Access Control
Broken access control, IDOR, and who can do what.
Injection and Input
XSS, SQL injection, and untrusted input.
Scanners vs Research
Why scanners miss the bugs that matter.
Attack Teardowns
Step by step walkthroughs of real bug classes.
Latest writing
-
How to Test Access Control: A Step by Step Method for Web Apps and APIs
How to test access control in a web app or API: the accounts to set up, six steps in order, what a correct denial looks like, and where automation stops.
-
Privilege Escalation Examples: Five Ways an Ordinary Account Becomes an Admin
Five privilege escalation examples in a web app, each with the request that causes it: writable role fields, stale tokens, invite abuse, and support tools.
-
Stored XSS Example: How One Saved Comment Runs in Everyone Else’s Browser
A worked stored XSS example: the request that plants the script, the page that runs it, where the bug really hides, and how to find and fix it properly.
-
Business Logic Vulnerability Examples: Five Valid Requests That Break the Rules
Five business logic vulnerability examples with real requests: client set prices, negative quantities, reused coupons, skipped steps, and reset trials.
-
Broken Access Control Examples: Five Requests That Should Have Been Denied
Five broken access control examples with the exact requests and responses, why each one looks like valid traffic, and how to find and fix them in your app.
-
BadUSB Attack: When a USB Stick Pretends to Be Your Keyboard
A BadUSB attack reprograms a USB stick to pose as a keyboard and type commands your computer trusts. Learn how HID spoofing works and how to defend.