The UnboundCompute blog

Writing on web security

Many Shot Jailbreaking: How a Long Context Window Becomes an Attack Surface

Many shot jailbreaking floods a long context window with fake example dialogues so a model learns to comply, then asks the real…
Cross Site Leaks: Reading Secrets You Are Never Allowed to See

A malicious page can run cross site leaks to infer secrets about a logged in victim by watching browser side effects the…
HTTP/2 Rapid Reset: How a Cancel Frame Became a Record DDoS

HTTP/2 Rapid Reset (CVE-2023-44487) abuses stream cancellation to flood a server past its concurrency limit. How the record DDoS worked, and how…
JWKS Spoofing: When a JWT Header Tells the Server Which Key to Trust

JWKS spoofing tricks a JWT verifier into loading an attacker chosen key through the kid, jku, and x5u header fields. See the…
ECDSA Nonce Reuse: How One Repeated Number Leaks the Private Key

ECDSA nonce reuse leaks your private key in two steps. See the algebra, a worked example, the Sony PS3 and Android Bitcoin…
OAuth redirect_uri Manipulation: How a Loose Callback Check Leaks Your Code

OAuth redirect_uri manipulation lets an attacker steal your authorization code when the server matches the callback loosely. See the leak and how…
AES GCM Nonce Reuse: The Forbidden Attack Explained

AES GCM nonce reuse breaks both secrecy and integrity. Learn how the forbidden attack recovers the authentication key, why nonces repeat, and…
Hash Length Extension Attack: How to Forge a MAC Without the Secret

A hash length extension attack forges a valid MAC for a longer message without the secret key. Learn how it works, see…
Double Clickjacking: The Clickjacking Revival That Beats Frame Defenses

Double clickjacking uses the gap between two clicks to hijack OAuth grants and account changes, slipping past old frame defenses. How it…
Poisoned Pipeline Execution: When Your CI Runs Attacker Code With Your Secrets

Poisoned pipeline execution runs attacker code inside your CI/CD with its secrets and deploy access. Learn the three flavors and how to…