The UnboundCompute blog

Writing on web security

How a Device Decides to Trust Its Own Firmware

How secure boot builds a chain of trust from immutable boot ROM and eFuses upward, and the real ways attackers break the…
What Actually Happens In A Kernel Use After Free

A deep technical look at a kernel use after free: how SLUB lays out heap memory, the exact moment a freed slot…
How the eBPF verifier works, and where its proof has broken

How the eBPF verifier tries to prove untrusted code is safe in ring 0, and the bounds tracking bugs that turned that…
Instance metadata service: the 169.254.169.254 credential leak

The instance metadata service at 169.254.169.254 hands a cloud VM its role credentials. How it works, how SSRF steals them, and how…
What is DOM based XSS?

Learn how dom based xss runs attacker code in the browser through unsafe JavaScript sinks, why server filters miss it, and how…
What is CSV injection (formula injection)?

CSV injection turns stored user text into live spreadsheet formulas on export. Learn how formula injection works, how to detect it, and…
What is an open redirect vulnerability?

An open redirect vulnerability lets an attacker forward users from a trusted site to a malicious one. Learn how it works, why…
What is path traversal?

Learn how a path traversal bug turns a file parameter into a read of your secrets and source code, and the exact…
What is prototype pollution?

Learn what prototype pollution is, how a single JSON write poisons Object.prototype, why it leaks into other objects, and how to detect…
What is CSRF (cross site request forgery)?

A csrf attack tricks a logged in browser into sending a request the user never meant. Learn how it works, what makes…