DEV Community

#infosec

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel
rxkov profile
Rxkov

CSWSH: Four Major WebSocket Frameworks Default to Vulnerable While Attackers Get a Bidirectional Channel

#cybersecurity #infosec #security
Comments
6 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
rxkov profile
Rxkov

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked
rxkov profile
Rxkov

RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked

#api #cybersecurity #infosec #security
Comments
6 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
rxkov profile
Rxkov

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
CVE-2024-55591: How an Auth Bypass Became an Internet-Scale Firewall Takeover
rxkov profile
Rxkov

CVE-2024-55591: How an Auth Bypass Became an Internet-Scale Firewall Takeover

#cybersecurity #infosec #security
Comments
5 min read
GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls
rxkov profile
Rxkov

GraphQL APQ Registration Bypasses Query Allowlists and Introspection Controls

#api #cybersecurity #infosec #security
Comments
5 min read
GraphQL in Production: Introspection, Alias Batching, and Rate Limit Bypass on Real APIs
rxkov profile
Rxkov

GraphQL in Production: Introspection, Alias Batching, and Rate Limit Bypass on Real APIs

#api #cybersecurity #infosec #security
Comments
6 min read
Subdomain Takeover Severity Comes From Security Context, Not the Exploit Mechanism
rxkov profile
Rxkov

Subdomain Takeover Severity Comes From Security Context, Not the Exploit Mechanism

#cybersecurity #infosec #security
Comments
6 min read
GraphQL's Six Default Attack Surfaces
rxkov profile
Rxkov

GraphQL's Six Default Attack Surfaces

#api #cybersecurity #infosec #security
Comments
5 min read
XXE in APIs: Discovering Hidden XML Acceptance and Exfiltrating Data via OOB
rxkov profile
Rxkov

XXE in APIs: Discovering Hidden XML Acceptance and Exfiltrating Data via OOB

#api #cybersecurity #infosec #security
Comments
6 min read
OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability
rxkov profile
Rxkov

OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability

#authentication #cybersecurity #infosec #security
Comments
6 min read
GraphQL as Attack Surface: Introspection, Batching, and Schema Enumeration
rxkov profile
Rxkov

GraphQL as Attack Surface: Introspection, Batching, and Schema Enumeration

#api #cybersecurity #infosec #security
Comments
6 min read
CT Logs for OSINT: Map Subdomains and Infrastructure Without Sending a Single Packet
rxkov profile
Rxkov

CT Logs for OSINT: Map Subdomains and Infrastructure Without Sending a Single Packet

#cybersecurity #infosec #security
Comments
5 min read
CT Logs: Your Infrastructure Inventory Is Public Before DNS Propagates
rxkov profile
Rxkov

CT Logs: Your Infrastructure Inventory Is Public Before DNS Propagates

#cybersecurity #infosec #security
Comments
5 min read
Working: API file upload defenses fail because validator fragmentation across upload paths leaves one path always unprotected
rxkov profile
Rxkov

Working: API file upload defenses fail because validator fragmentation across upload paths leaves one path always unprotected

#api #cybersecurity #infosec #security
Comments
6 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.