The UnboundCompute blog
Writing on web security
-
What is a Mass Assignment Vulnerability? How Extra Fields Break Access Control
A mass assignment vulnerability lets a user set hidden fields like role or is_admin by sending extra JSON keys. Learn how to…
-
What is Host Header Injection? How a Trusted Header Goes Wrong
Host header injection lets an attacker poison password reset emails, caches, and routing by forging one HTTP header. Learn how to detect…
-
What is a CORS Misconfiguration? How It Leaks Data
A CORS misconfiguration lets a malicious site read a logged in user’s data. Learn the bad header patterns, how to detect them,…
-
What is Server Side Template Injection? SSTI Explained
Server side template injection lets user input run as template code on your server. See how {{7*7}} becomes 49, escalates to RCE,…
-
Kubernetes service account token abuse: from one pod to cluster admin
How a Kubernetes service account token mounted in a pod becomes an attacker key to the API server, and how least privilege…
-
SAML Signature Wrapping Explained: When a Valid Signature Lies
SAML signature wrapping lets a valid signature bless one element while your app reads another. Learn how this XML attack bypasses login…
-
Dependency Confusion Attack Explained
A dependency confusion attack tricks your package manager into pulling an attacker’s public package over your private one. Learn how to stop…
-
RAG Data Poisoning: How Attackers Corrupt the Knowledge Base Behind an LLM
RAG data poisoning lets attackers plant false facts or hidden instructions in a knowledge base so an LLM retrieves and trusts them.…
-
The lethal trifecta in AI agents
The lethal trifecta is when an AI agent holds private data, untrusted content, and an outbound channel at once. Break one leg…
-
JWT Algorithm Confusion Attack Explained
A JWT algorithm confusion attack tricks a server into verifying forged tokens. Learn the alg:none bug, the RS256 to HS256 key swap,…