The UnboundCompute blog

Writing on web security

Teardown: how an IDOR quietly exposes another user’s data

A step by step idor example using an invented app. Map the app, change one id, read another user’s note, then learn…
How do hackers find vulnerabilities?

How do hackers find vulnerabilities? They map an app, learn its rules, guess where assumptions break, test access and inputs, then prove…
What is command injection? Examples explained

Command injection lets attacker input run server commands. See a clear ping tool example, real impact, and how to fix it with…
What is web application security?

Web application security explained for beginners: what it is, why it matters, the main risk areas like input, access control, and logic,…
Broken object level authorization and IDOR, with examples

Broken object level authorization and IDOR explained with a clear API example, why APIs are prone to it, how to detect it,…
What is privilege escalation? Examples explained

What is privilege escalation? See clear examples of horizontal and vertical attacks, how they tie to broken access control, and how to…
The most common web vulnerabilities, explained simply

A plain words guide to the most common web vulnerabilities, with a tiny example for each so a newcomer can spot and…
SAST vs DAST vs IAST, what is the difference?

SAST vs DAST vs IAST explained plainly. See what each scanner catches, what it misses, where false positives come from, and why…
What is SQL injection and how does it work?

Learn what SQL injection is and how it works. See a simple login example, what an attacker can do, why it still…
What is XSS and how does it work? With examples

What is cross site scripting and how does it work? Learn stored, reflected, and DOM XSS with simple examples, plus how to…