The UnboundCompute blog
Writing on web security
-
OAuth redirect_uri Manipulation: How a Loose Callback Check Leaks Your Code
OAuth redirect_uri manipulation lets an attacker steal your authorization code when the server matches the callback loosely. See the leak and how…
-
AES GCM Nonce Reuse: The Forbidden Attack Explained
AES GCM nonce reuse breaks both secrecy and integrity. Learn how the forbidden attack recovers the authentication key, why nonces repeat, and…
-
Hash Length Extension Attack: How to Forge a MAC Without the Secret
A hash length extension attack forges a valid MAC for a longer message without the secret key. Learn how it works, see…
-
Double Clickjacking: The Clickjacking Revival That Beats Frame Defenses
Double clickjacking uses the gap between two clicks to hijack OAuth grants and account changes, slipping past old frame defenses. How it…
-
Poisoned Pipeline Execution: When Your CI Runs Attacker Code With Your Secrets
Poisoned pipeline execution runs attacker code inside your CI/CD with its secrets and deploy access. Learn the three flavors and how to…
-
postMessage Vulnerabilities: When Cross Origin Messages Turn Into XSS
postMessage vulnerabilities let any site message your page or leak your data. Learn the origin check and targetOrigin mistakes, the XSS chain,…
-
Client Side Path Traversal: When the Browser Sends Your Fetch Somewhere Else
Client side path traversal lets attacker input redirect a browser fetch to a different endpoint. Learn how it works, how it chains,…
-
Cross Site WebSocket Hijacking: The CSRF of WebSockets
Cross site WebSocket hijacking lets a malicious page open an authenticated socket to your logged in app. Learn how it works and…
-
System Prompt Extraction: Why Keeping the Prompt Secret Is Not Security
System prompt extraction gets an LLM app to reveal its hidden prompt. Learn how it works and why secrets should never live…
-
Denial of Wallet: When Attackers Run Up Your AI Agent’s Bill
A denial of wallet attack keeps your AI agent running and drives the bill up instead of taking it offline. Learn how…