The UnboundCompute blog

Writing on web security

AI in Security Testing: What It Actually Does and Where It Falls Down

A vendor neutral guide to ai in security testing: where AI genuinely helps with recon, fuzzing, logic flaws, and triage, and where…
LLM Security Testing Tools: A Vendor Neutral Landscape Guide

A vendor neutral map of llm security testing tools: tools that use LLMs to test, and tools that red team LLM apps,…
AI Security Testing: A Vendor Neutral Guide to Where AI Helps and Where It Fails

AI security testing uses AI to find and prove software vulnerabilities. See where it helps, where it fails, the tool categories, and…
The GraphQL Attack Surface: Introspection, Query DoS, Broken Authorization, and Injection

The graphql attack surface comes from letting the client shape the query. See how introspection, nested queries, and broken field authorization get…
What Is a Padding Oracle Attack and How It Decrypts CBC Without the Key

A padding oracle attack decrypts CBC ciphertext without the key by abusing one bit of padding feedback. See the byte at a…
How NTLM Relay Works and Why a Portable Authentication Breaks Active Directory

An ntlm relay forwards a victim’s Windows authentication to a server it never meant to reach. See the handshake, the coercion, the…
What Is a Hash Flooding Attack and Why It Stalls a Server With Bytes

A hash flooding attack crafts colliding keys to collapse a hash table to O(n) and pin a CPU core with one small…
How Rowhammer Works: Flipping Bits in Memory You Were Never Allowed to Touch

Rowhammer is a hardware attack that leaks charge between packed DRAM cells to flip bits in rows you cannot access. See the…
How Bluetooth LE Pairing Breaks: KNOB, BLESA, Just Works, and Sniffed Keys

How bluetooth le pairing breaks: the KNOB entropy downgrade, BLESA reconnection spoofing, the Just Works model, sniffed keys, and the defenses that…
What Is Sigreturn Oriented Programming and Why One Gadget Owns the CPU

Sigreturn oriented programming forges a signal frame on the stack so one syscall sets every register at once. See how SROP chains…