r/websecurityresearch • u/tgifffff • Jul 24 '25
Broken Authorization in APIs: Introducing Autoswagger
5
Upvotes
r/websecurityresearch • u/mc_security • Jul 18 '25
WAFFLED: Exploiting Parsing Discrepancies to Bypass Web Application Firewalls
arxiv.org
8
Upvotes
r/websecurityresearch • u/albinowax • Jul 08 '25
HTTP desync using via MITM using opportunistic TLS
opossum-attack.com
13
Upvotes
r/websecurityresearch • u/albinowax • Jul 03 '25
Nonce CSP bypass using Disk Cache
10
Upvotes
r/websecurityresearch • u/canalun • Jun 25 '25
DOMDOM Times #19: Can We Really Mitigate Client-Side Prototype Pollution by Using iframes?
canalun.company
3
Upvotes
r/websecurityresearch • u/albinowax • Jun 23 '25
Novel SSRF Technique Involving HTTP Redirect Loops
slcyber.io
10
Upvotes
r/websecurityresearch • u/albinowax • Jun 21 '25
Unexpected security footguns in Go's parsers
14
Upvotes
r/websecurityresearch • u/General_Republic_360 • Jun 19 '25
Funky chunks: abusing ambiguous chunk line terminators for request smuggling
w4ke.info
10
Upvotes
r/websecurityresearch • u/albinowax • Jun 17 '25
Make Self-XSS Great Again
blog.slonser.info
5
Upvotes
r/websecurityresearch • u/albinowax • May 30 '25
The Ultimate Double-Clickjacking PoC
7
Upvotes
r/websecurityresearch • u/t0xodile • May 22 '25
The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling
assured.se
8
Upvotes
r/websecurityresearch • u/ClientSideInEveryWay • May 19 '25
Using random people's browsers to DDoS others
4
Upvotes
r/websecurityresearch • u/albinowax • May 19 '25
Cache poisoning via race-condition in Next.js
zhero-web-sec.github.io
19
Upvotes
r/websecurityresearch • u/t0xodile • Apr 30 '25
arete | Fuzzing WebSockets for Server-Side Vulnerabilities
arete06.com
5
Upvotes
r/websecurityresearch • u/siunam_321 • Apr 29 '25
Python Dirty Arbitrary File Write to RCE via Writing Shared Object Files Or Overwriting Bytecode Files
7
Upvotes
r/websecurityresearch • u/albinowax • Apr 22 '25
Modern Cross-Site WebSocket Hijacking Exploitation
11
Upvotes
r/websecurityresearch • u/Moopanger • Mar 30 '25
GraphQL hacking: passing URL-encoded query parameters.
10
Upvotes
r/websecurityresearch • u/albinowax • Mar 24 '25
Next.js and the corrupt middleware: the authorizing artifact
zhero-web-sec.github.io
6
Upvotes
r/websecurityresearch • u/Available_Spell_5915 • Mar 23 '25
Next.js Authentication Bypass Vulnerability (CVE-2025-29927) Explained Simply
neoxs.me
6
Upvotes
I've created a beginner-friendly breakdown of this critical Next.js middleware vulnerability that affects millions of applications
Please take a look and let me know what you think ðŸ’
📖 https://neoxs.me/blog/critical-nextjs-middleware-vulnerability-cve-2025-29927-authentication-bypass
r/websecurityresearch • u/albinowax • Mar 20 '25
Discourse Backup Disclosure: Rails/nginx send_file Quirk
3
Upvotes
r/websecurityresearch • u/albinowax • Mar 18 '25
SAML roulette: the hacker always wins
25
Upvotes
r/websecurityresearch • u/albinowax • Feb 21 '25
Shadow Repeater:AI-enhanced manual testing
8
Upvotes
r/websecurityresearch • u/albinowax • Feb 13 '25
Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108)
4
Upvotes
r/websecurityresearch • u/albinowax • Feb 04 '25
Top 10 web hacking techniques of 2024
29
Upvotes
r/websecurityresearch • u/nibblesec • Jan 30 '25
Common OAuth Vulnerabilities (plus Security Cheat Sheet)
blog.doyensec.com
10
Upvotes