Notes & research

Blog

Application security, curious findings, and lessons from the details.

February 23, 2015

Non-Root-Relative Path Overwrite (RPO) in IIS and .Net applications

February 22, 2015

Analysis of setting cookies for third party websites in different browsers

IIS Short File Name Disclosure is back! Is your server vulnerable?

Upload a web.config File for Fun & Profit

File Upload and PHP on IIS: >=? and <=* and "=.

Even uploading a JPG file can lead to Cross-Site Content Hijacking (client-side attack)!

How did I bypass everything in modsecurity evasion challenge?

January 13, 2014

Catch-up on Flash XSS exploitation Part 3 – XSS by embedding a flash file

October 21, 2013

Yahoo bug bounty program – LFI reported and patched!

October 16, 2013

Catch-up on Flash XSS exploitation Part 2 – “navigateToURL” and “jar:” protocol!