Etiqueta: Practitioner

Exploiting Java deserialization with Apache Commons

Exploiting Ruby deserialization using a documented gadget chain

Exploiting PHP deserialization with a pre-built gadget chain

Stealing OAuth access tokens via an open redirect

JWT authentication bypass via weak signing key

JWT authentication bypass via kid header path traversal

CORS vulnerability with trusted insecure protocols

JWT authentication bypass via jku header injection

JWT authentication bypass via jwk header injection

Performing CSRF exploits over GraphQL