The UnboundCompute blog
Writing on web security
-
Reachability Analysis and Whether a Bug Is Exploitable
Reachability analysis asks if attacker input can actually reach a flagged function, so you fix the real bugs and drop the theoretical…
-
How before_action Authorization Bypasses Happen in Rails
See how before_action authorization in Rails gets bypassed by skips, only and except scopes, inheritance, and callback order, and how to find…
-
Fail Open Access Control and the Empty Allowlist
Fail open access control lets requests through when a check goes empty or missing. See how an empty allowlist permits everything and…
-
Interprocedural Taint Analysis Explained
Interprocedural taint analysis follows user input across functions, returns, and files to a sink, so an analyzer confirms a real path, not…
-
Source to Sink Analysis Explained
Source to sink analysis traces attacker input from where it enters to where it gets used, so you flag a real exploitable…
-
How to Test Access Control: A Step by Step Method for Web Apps and APIs
How to test access control in a web app or API: the accounts to set up, six steps in order, what a…
-
Privilege Escalation Examples: Five Ways an Ordinary Account Becomes an Admin
Five privilege escalation examples in a web app, each with the request that causes it: writable role fields, stale tokens, invite abuse,…
-
Stored XSS Example: How One Saved Comment Runs in Everyone Else’s Browser
A worked stored XSS example: the request that plants the script, the page that runs it, where the bug really hides, and…
-
Business Logic Vulnerability Examples: Five Valid Requests That Break the Rules
Five business logic vulnerability examples with real requests: client set prices, negative quantities, reused coupons, skipped steps, and reset trials.
-
Broken Access Control Examples: Five Requests That Should Have Been Denied
Five broken access control examples with the exact requests and responses, why each one looks like valid traffic, and how to find…