Writing on web security

An ntlm relay forwards a victim’s Windows authentication to a server it never meant to reach. See the handshake, the coercion, the…

A hash flooding attack crafts colliding keys to collapse a hash table to O(n) and pin a CPU core with one small…

Rowhammer is a hardware attack that leaks charge between packed DRAM cells to flip bits in rows you cannot access. See the…

How bluetooth le pairing breaks: the KNOB entropy downgrade, BLESA reconnection spoofing, the Just Works model, sniffed keys, and the defenses that…

Sigreturn oriented programming forges a signal frame on the stack so one syscall sets every register at once. See how SROP chains…

A container escape breaks a process out of its namespaces onto the host kernel. Walk the cgroups v1 release_agent technique, CVE-2022-0492, and…

Web cache deception tricks a CDN into storing a victim’s authenticated page under a URL the attacker can fetch. See the mechanism,…

A dns rebinding attack swaps a hostname’s IP after a page loads so a browser reaches private devices. See the mechanism, real…

A subdomain takeover happens when a forgotten DNS record points at a deleted cloud resource an attacker can claim. See the mechanism,…

How http request smuggling works: two servers disagree on where a request ends, an attacker hides a second request, and the back…