↓Skip to main content

Research

2020

OhMyZsh dotenv Remote Code Execution

April 8, 2020·3 mins

2019

Practical Approaches for Testing and Breaking JWT Authentication

October 25, 2019·8 mins

[Research] Overview of the Application-Level Security of the Swiss E-voting System

April 16, 2019·1 min

Backchannel Leaks on Strict Content-Security Policy

January 18, 2019·2 mins

2018

Practical Protection Against DNS Rebinding Attacks

July 31, 2018·4 mins

Creating an Emojis PHP Webshell

July 23, 2018·1 min

Using HTML Attribute Separators for Bypassing WAF XSS Filters

July 17, 2018·2 mins

Bypassing CSP by Abusing JSONP Endpoints

January 16, 2018·3 mins

2017

Using Ubuntu .DESKTOP as a Malware Vector

April 8, 2017·3 mins

Exploiting Misconfigured Apache server-status Instances with server-status_PWN

January 13, 2017·2 mins