DEV Community

#infosec

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Working: CORS misconfigurations escape automated detection
rxkov profile
Rxkov

Working: CORS misconfigurations escape automated detection

#api #cybersecurity #infosec #security
Comments
5 min read
Wayback Machine for OSINT: What Stayed Archived After Remediation
rxkov profile
Rxkov

Wayback Machine for OSINT: What Stayed Archived After Remediation

#cybersecurity #infosec #security
Comments
5 min read
XXE in Document-Processing APIs: The Attack Surface Nobody Hardens
rxkov profile
Rxkov

XXE in Document-Processing APIs: The Attack Surface Nobody Hardens

#cybersecurity #infosec #security
Comments
5 min read
API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP
rxkov profile
Rxkov

API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP

#api #cybersecurity #infosec #security
Comments
6 min read
Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint
rxkov profile
Rxkov

Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint

#authentication #cybersecurity #infosec #security
Comments
5 min read
CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel
rxkov profile
Rxkov

CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel

#cybersecurity #infosec #security
Comments
6 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
rxkov profile
Rxkov

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked
rxkov profile
Rxkov

RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked

#api #cybersecurity #infosec #security
Comments
6 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
rxkov profile
Rxkov

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls
rxkov profile
Rxkov

GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls

#api #cybersecurity #infosec #security
Comments
5 min read
CVE-2024-55591: How an Auth Bypass Became an Internet-Scale Firewall Takeover
rxkov profile
Rxkov

CVE-2024-55591: How an Auth Bypass Became an Internet-Scale Firewall Takeover

#cybersecurity #infosec #security
Comments
5 min read
GraphQL in Production: Introspection, Alias Batching, and Rate Limit Bypass on Real APIs
rxkov profile
Rxkov

GraphQL in Production: Introspection, Alias Batching, and Rate Limit Bypass on Real APIs

#api #cybersecurity #infosec #security
Comments
6 min read
Subdomain Takeover Severity Comes From Security Context, Not the Exploit Mechanism
rxkov profile
Rxkov

Subdomain Takeover Severity Comes From Security Context, Not the Exploit Mechanism

#cybersecurity #infosec #security
Comments
6 min read
GraphQL's Six Default Attack Surfaces
rxkov profile
Rxkov

GraphQL's Six Default Attack Surfaces

#api #cybersecurity #infosec #security
Comments
5 min read
OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability
rxkov profile
Rxkov

OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability

#authentication #cybersecurity #infosec #security
Comments
6 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.