Skip to main content

Security Guides & Technical Deep-Dives

Attack mechanics, reproducible labs, detection rules, and fix patterns for the vulnerability classes we test for and harden against, written for engineers, not as marketing copy.

Injection & Deserialization Attacks

How untrusted input becomes a query, a template, markup, or a reconstructed object the server executes.

  • SQL Injection Explained

    CWE-89: classic and blind attack classes, real CVEs including Metabase CVE-2026-72898 (CVSS 10.0), and parameterized-query fixes across five languages.

  • XXE Explained

    CWE-611: in-band file disclosure, SSRF, and blind out-of-band attack classes, with real CVEs and per-language fix patterns.

  • Server-Side Template Injection (SSTI) Explained

    CWE-1336: template-engine fingerprinting, high-severity real CVEs, and a verified RCE chain in a reproducible lab.

  • Insecure Deserialization Explained

    CWE-502: how gadget chains turn object reconstruction into RCE in Java, Python, PHP, and Node.js.

  • SSRF Explained

    CWE-918: cloud metadata credential theft, deny-list bypasses, and allowlist-based fixes, with a reproducible local lab.

Authentication & Access Control

Identity verification and object-level authorization failures.

  • FIDO2 vs Passkeys

    Protocol-level comparison of FIDO2 (WebAuthn + CTAP2) and passkeys: discoverable credentials, attestation, and relying-party implementation guidance.

  • JWT Algorithm Confusion Explained

    How verifiers that trust the attacker-controlled alg header let anyone forge admin tokens, with detection rules and allowlist fixes.

  • IDOR Explained

    Missing object-level authorization (BOLA): a two-account detection methodology and ownership-check fix patterns.

Business Logic & Concurrency

Flaws in application flow and timing, not a single broken check.

  • Race Conditions Explained

    CWE-362 / CWE-367: check-then-use race windows, a reproducible coupon-redemption lab, and atomic fix patterns.

Infrastructure & Configuration Hardening

Defense-in-depth configuration for the platforms these applications run on.

  • Kubernetes Security Best Practices

    A hardening checklist with copy-paste YAML: Pod Security Standards, default-deny NetworkPolicies, RBAC least privilege, and image supply-chain gates.

  • Security Headers Checklist

    Priority-ordered HTTP security headers with exact values for HSTS, CSP, and Permissions-Policy, plus curl-based verification and a CI gate script.

Found one of these in your own stack? Book an audit and we'll find the rest.