Leaking internal headers in Flask Ninja with deserialization
Jul 21, 2026There’s an unfixed gadget living in Flask Ninja. Its HttpBearer authenticator reads the credential from a header …
research
View all
Stealing OAuth tokens of connected Microsoft accounts via open redirect in Harvest App
Oct 21, 2023Reported an OAuth token leak via open redirect in Harvest.
Breaking The Mutant Language's "Encryption (Writeup)"
Aug 15, 2023AppSec Village DEF CON 31 CTF^2 (developer) winning entry. Bypassed the encryption and mutation techniques of the Mutant …
blog
View all
Simple Prompts to get the System Prompts
Dec 30, 2024Exploring prompt injection techniques to extract hidden system prompts from popular AI wrappers and chatbots.
Utilizing unit testing frameworks as a vulnerability scanner
Jan 12, 2023How to use unit testing frameworks like xUnit for automated vulnerability scanning and exploit development.
You don’t need xss.rocks/xss.js
Dec 27, 2020Why data URLs are a powerful alternative to hosted JavaScript files for XSS testing and payload delivery.