2026-09-20 5 min
[notes]
OAuth, OIDC and SAML: Where Federated Trust Breaks
redirect_uri validation, PKCE, OIDC discovery, SAML signature wrapping and metadata, dynamic client registration and device-flow phishing.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-09-20 3 min
[notes]
DOM XSS, Prototype Pollution and Client-Side Gadgets
Sources and sinks that never reach the server, CSP bypass, DOM clobbering, client-side path traversal and prototype pollution on both sides of the wire.
2026-09-20 3 min
[notes]
Browser Trust Boundaries: CORS, CSRF and Redirects
Reflected origins with credentials, SameSite, modern CSRF against APIs, clickjacking, postMessage handlers and open redirects that carry real impact.
2026-09-20 4 min
[notes]
Reverse Proxy and Web Server Misconfigurations
Host header injection, path confusion between two normalizers, trusted headers, nginx alias, Apache .htaccess, IIS handlers and server-side includes.
2026-09-20 3 min
[notes]
HTTP Request Smuggling and Cache Attacks
CL.TE and TE.CL, HTTP/2 downgrades, desync races, cache poisoning and deception, plus parameter pollution read four different ways by four parsers.