The UnboundCompute blog
How web apps and APIs really break.
Clear, honest writing on web and API security. The common bugs, the ones automated scanners miss, and how a real finding is actually proven. Written for everyone from beginners to security teams.
What we write about
Vulnerability Basics
Plain explanations of how software actually breaks.
Access Control
Broken access control, IDOR, and who can do what.
Injection and Input
XSS, SQL injection, and untrusted input.
Scanners vs Research
Why scanners miss the bugs that matter.
Attack Teardowns
Step by step walkthroughs of real bug classes.
Latest writing
-
Node.js Deserialization: When a Serializer Revives Functions
Node.js deserialization bugs strike when a serializer revives function bodies from text and runs them on load. See the trick and why JSON.parse fixes it.
-
Ruby YAML Deserialization: When YAML.load Builds Arbitrary Objects
Ruby yaml deserialization lets the default Psych loader build arbitrary objects from YAML tags. See why safe_load matters and how to stop the RCE.
-
Ruby Marshal Deserialization: Why Marshal.load on Untrusted Data Is RCE
Ruby marshal deserialization rebuilds arbitrary objects when Marshal.load runs on untrusted bytes, a trigger for a gadget chain. See the fix.
-
Phar Deserialization: Object Injection With No unserialize() Call
Phar deserialization fires object injection when a file function touches a phar path, with no unserialize() in sight. See the trigger and the fix.
-
PHP Object Injection: When unserialize() Builds the Attacker’s Objects
PHP object injection turns unserialize() on user data into live objects whose magic methods fire a POP chain. See how it works and how to stop it.
-
PyYAML Deserialization: Why yaml.load Runs Code
PyYAML deserialization with the default loader builds objects from tags and runs code on load. See how yaml.load differs from yaml.safe_load.