Security

Authentication Bypass Security Guide 🆕 Updated September 12, 2026 — added the Veeam VSPC chain (CVE-2026-58073 + CVE-2026-58072): a GUID trusted as a credential, and a branch with no else. Authentication bypass vulnerabilities represent critical security flaws that allow attackers to circumvent authentication mechanisms and gain unauthorized access to systems, applications, or user accounts. Introduction Authentication bypass attacks target weaknesses in login mechanisms, session management, and access control implementations. These vulnerabilities can lead to complete account takeover, privilege escalation, and unauthorized access to sensitive data. ...

CSP policies regress silently. That’s the whole problem. Someone adds 'unsafe-inline' to script-src to unblock a third-party widget on a deadline. It ships. The policy that took a quarter to tighten is now decorative, and nothing anywhere fails. No test breaks, no alert fires, no reviewer catches it because the diff is one token long and the PR is about a marketing pixel. You find out months later, from an XSS report, if you find out at all. ...

Fourth in a series on building out-of-band application security testing (OAST) infrastructure from scratch. Earlier posts went down to the wire (JNDI, DNS, the sandbox). This one is about a quieter risk that kills more SaaS products than any exploit: one missing WHERE clause. In a multi-tenant app, the entire security model often reduces to a single sentence: every database read that returns user-owned data is filtered by the current user’s id. Get it right everywhere and tenants are isolated. Forget it in one endpoint — one db.query(Modifier).filter(Modifier.id == requested_id) without the owner_user_id check — and any user can read any other user’s data by guessing an integer. It’s the most common serious bug in SaaS, and it’s a bug of omission, which is exactly the kind code review is worst at catching. ...

Third in a series on building out-of-band application security testing (OAST) infrastructure from scratch. Post 1 hand-rolled a JNDI Reference; post 2 built the authoritative DNS server. This one is the riskiest feature in the whole platform: letting users run their own Python, in production, to shape the responses the listeners send back. The feature is simple to state and terrifying to implement: a user writes a Python function, and when a callback lands on their host, the server runs that function to decide what to answer. DNS rebinding, conditional payloads by source IP, crafting a JNDI reference on the fly — all of it wants user-supplied logic in the response path. Which means executing untrusted Python on your production box. ...

I’ve spent the last couple of years watching teams bolt an LLM onto a product and then look genuinely surprised when it does something dumb, dangerous, or both. The pattern is always the same. Ship first, wonder about security later. So when OWASP put together a Top 10 specifically for LLM applications, I was relieved. Finally there’s a shared vocabulary I can point at during a review instead of explaining prompt injection from scratch for the hundredth time. ...

🛡️ OWASP Top 10 2025 Series Complete guides to modern web application security vulnerabilities 📚 Complete Guide OWASP Top 10 2025: Complete Developer Guide Comprehensive overview of all vulnerabilities, rankings, and modern threat landscape 🎯 Individual Vulnerability Guides A01: Broken Access Control Includes SSRF A02: Security Misconfiguration Jumped to #2 A03: Software Supply Chain Failures New in 2025 A04: Cryptographic Failures A05: Injection A06: Vulnerable Components Coming Next A07: Authentication Failures Coming Soon A08: Integrity Failures Coming Soon A09: Logging & Monitoring Coming Soon A10: Exception Handling Coming Soon 👨‍💻 Written by Carl Sampson • Security researcher with 15+ years experience • OWASP Indianapolis Chapter founder ...

🛡️ OWASP Top 10 2025 Series Complete guides to modern web application security vulnerabilities 📚 Complete Guide OWASP Top 10 2025: Complete Developer Guide Comprehensive overview of all vulnerabilities, rankings, and modern threat landscape 🎯 Individual Vulnerability Guides A01: Broken Access Control Includes SSRF A02: Security Misconfiguration Jumped to #2 A03: Software Supply Chain Failures New in 2025 A04: Cryptographic Failures A05: Injection A06: Vulnerable Components Coming Next A07: Authentication Failures Coming Soon A08: Integrity Failures Coming Soon A09: Logging & Monitoring Coming Soon A10: Exception Handling Coming Soon 👨‍💻 Written by Carl Sampson • Security researcher with 15+ years experience • OWASP Indianapolis Chapter founder ...

🛡️ OWASP Top 10 2025 Series Complete guides to modern web application security vulnerabilities 📚 Complete Guide OWASP Top 10 2025: Complete Developer Guide Comprehensive overview of all vulnerabilities, rankings, and modern threat landscape 🎯 Individual Vulnerability Guides A01: Broken Access Control Includes SSRF A02: Security Misconfiguration Jumped to #2 A03: Software Supply Chain Failures New in 2025 A04: Cryptographic Failures A05: Injection A06: Vulnerable Components Coming Next A07: Authentication Failures Coming Soon A08: Integrity Failures Coming Soon A09: Logging & Monitoring Coming Soon A10: Exception Handling Coming Soon 👨‍💻 Written by Carl Sampson • Security researcher with 15+ years experience • OWASP Indianapolis Chapter founder ...

I’ve been doing application security long enough to get twitchy whenever a book has “AI” on the cover. Most of what crosses my desk in that genre is hype wearing a lab coat. Lots of talk about the future, very little you can use on a Monday morning. So I cracked open Steve Wilson’s The Developer’s Playbook for Large Language Model Security: Building Secure AI Applications expecting the usual letdown. I was wrong, and I’m glad to say so. ...

🛡️ OWASP Top 10 2025 Series Complete guides to modern web application security vulnerabilities 📚 Complete Guide OWASP Top 10 2025: Complete Developer Guide Comprehensive overview of all vulnerabilities, rankings, and modern threat landscape 🎯 Individual Vulnerability Guides A01: Broken Access Control Includes SSRF A02: Security Misconfiguration Jumped to #2 A03: Software Supply Chain Failures New in 2025 A04: Cryptographic Failures A05: Injection A06: Vulnerable Components Coming Next A07: Authentication Failures Coming Soon A08: Integrity Failures Coming Soon A09: Logging & Monitoring Coming Soon A10: Exception Handling Coming Soon 👨‍💻 Written by Carl Sampson • Security researcher with 15+ years experience • OWASP Indianapolis Chapter founder ...

I’ve been hunting SSRF bugs in Python applications for over five years, and the number of vulnerable codebases I encounter is honestly terrifying. Flask apps with requests.get(user_input) scattered everywhere. Django views that blindly fetch URLs from form data. FastAPI endpoints that turn your server into an attacker’s proxy. The worst part? Most developers don’t realize they’re building SSRF vulnerabilities until it’s too late. By then, attackers have already stolen your AWS credentials or mapped your entire internal network. ...

CSRF and SSRF sound like they’re related - they both have “request forgery” in the name, after all. But they’re completely different beasts that’ll bite you in completely different ways. I’ve spent way too many nights debugging both of these vulnerabilities, and the confusion between them has cost teams serious security incidents. Let me break down exactly what each one does and how to stop them before they wreck your app. ...

Back in January I wrote about the launch of AppSec.fyi, the curated application security resource library I built and maintain. Three months later, I’ve added enough to warrant an update. What started as a clean list of links organized by vulnerability class has turned into something closer to a full reference platform. By the Numbers The resource count has crossed 2,241 items spread across 24 distinct categories. That’s a significant jump from the handful of core vulnerability classes I launched with. The original categories — XSS, SQLi, SSRF, IDOR, XXE, RCE, CSRF — are still there, but I’ve expanded into areas that reflect where application security is actually headed. ...

I run about a dozen MCP servers in my daily workflow. Playwright for browser automation, Raindrop for bookmarks, Todoist for tasks, a couple of custom ones. Every time I start a Claude Code session, my agent loads all of their tool descriptions into context and uses them to decide what to call. Last month I started thinking about what would happen if one of those tool descriptions was lying to me. ...

There’s no Python library for parsing Content Security Policy headers. I checked PyPI, I checked GitHub — nothing. Google has a CSP Evaluator web tool and an npm package, but if you want to analyze CSP programmatically in Python — for recon scripts, bug bounty automation, or CI pipelines — you’re on your own. So I built one. csp-toolkit is a Python library and CLI tool that parses CSP headers, runs 21 weakness checks, finds bypass vectors against a database of 79 known-exploitable domains, scores policies A+ to F, and does a lot more. The current release is v0.8.1 on PyPI (changelog, docs). ...

Use-after-free (UaF) vulnerabilities are one of the most exploited classes of memory corruption bugs. They’ve been at the heart of browser zero-days, Linux kernel privilege escalations, and countless CVEs. Despite being well understood, they remain stubbornly common — a testament to how easy they are to introduce and how hard they are to catch with conventional testing. What Is a Use-After-Free? A use-after-free occurs when a program: Allocates a chunk of memory on the heap Frees that memory (returning it to the allocator) Continues to use a pointer that still references the now-freed region The memory is no longer “owned” by the program. The allocator is free to give it to something else. When the program reads or writes through the dangling pointer, it’s operating on memory that may now belong to an entirely different object — or may have been zeroed, corrupted, or repurposed by an attacker. ...

As security professionals, we spend a lot of time searching through resources, documentation, and references while working on projects or investigating vulnerabilities. I got tired of hunting for the same links over and over, so I built AppSec.fyi — a curated collection of application security resources that serves as the go-to reference I always wanted. What is AppSec.fyi? AppSec.fyi is a centralized hub that organizes security knowledge across multiple domains, making it easy to find authoritative sources and reference materials for common vulnerabilities and security topics. I describe it as “a somewhat curated list of links to various topics in appsec” — though that undersells it a bit at this point. ...

Variant hunting is one of the highest-impact activities in modern security research. Rather than looking for single, isolated vulnerabilities, variant hunting focuses on identifying patterns of flaws and tracking down all other instances of that pattern across products, codebases, or architectures. If a traditional vulnerability report is a single missing brick, variant hunting is discovering that the entire wall was built using the wrong blueprint. Quick Answer: What is Variant Hunting? Variant hunting is a security research methodology that: ...

I’ve been writing Python applications for over a decade, and I’ve seen every possible way to screw up security. The good news? Most Python security issues fall into predictable patterns that you can defend against systematically. This guide covers the three vulnerabilities that keep showing up in my security reviews: SSRF, SQL injection, and XSS. Master these defenses, and you’ll stop 80% of the attacks before they start. 📊 OWASP 2025 Context: These vulnerabilities map directly to the OWASP Top 10 2025 - SSRF is now part of A01 Broken Access Control, injection dropped to A05 (thanks to better frameworks), while misconfigurations jumped to #2. Understanding the current threat landscape helps you prioritize your security efforts. ...

HTTP Request Smuggling (HRS) is a powerful web application vulnerability that exploits discrepancies in how different servers or intermediaries parse and handle HTTP requests. This misalignment can allow an attacker to “smuggle” a malicious request through a front-end server (such as a load balancer, proxy, or CDN) so that it is interpreted differently by the back-end server. How HTTP Request Smuggling Works Modern web applications often rely on chains of intermediaries — proxies, reverse proxies, CDNs, and application servers. These components must all agree on where one HTTP request ends and the next begins. If they disagree, attackers can craft specially malformed requests that cause desynchronization. ...

Server-Side Request Forgery (SSRF) is a type of security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources. This can lead to unauthorized access to sensitive data, manipulation of server behavior, or even exploitation of other services within the network. SSRF exploits the trust that a server has in its own requests, allowing attackers to leverage this trust to perform actions that would typically be restricted. ...

I’ve been dealing with SSRF vulnerabilities for years, and they’re honestly one of the scariest bugs you’ll encounter. While everyone obsesses over XSS and SQL injection, SSRF quietly lets attackers break into your internal network and steal your cloud credentials. The worst part? Most developers don’t even know their code is vulnerable until it’s too late. Update 2026: SSRF has been consolidated into A01: Broken Access Control in the OWASP Top 10 2025, reflecting how attackers actually chain SSRF with access control bypasses. This guide covers SSRF-specific defenses, but check the complete OWASP 2025 analysis for the broader access control security picture. ...

The Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware security weaknesses maintained by the MITRE Corporation. It assigns each type of vulnerability a unique identifier, a description, and guidance on prevention. If you work in application security — or write code that needs to be secure — CWE is a foundational reference. Quick Answer: What is CWE? CWE (Common Weakness Enumeration) is a standardized catalog of software security weaknesses that: ...

XML External Entity (XXE) injection exploits applications that parse XML input without disabling external entity resolution. If the XML parser is misconfigured (which many are by default), an attacker can define custom entities that read local files, make network requests, or cause denial of service. These payloads are for authorized security testing only. What is XXE? When an XML parser processes a document, it can resolve entities defined in the DOCTYPE declaration. External entities use the SYSTEM keyword to reference files or URLs. If the parser resolves these without restriction, the attacker controls what the server reads and where it sends data. ...

Content Security Policy (CSP) is a browser security mechanism that controls which resources a web page is allowed to load. By declaring a policy via HTTP header, you tell the browser exactly which scripts, styles, images, fonts, and connections are permitted. Anything not explicitly allowed is blocked. CSP is one of the most effective defenses against Cross-Site Scripting (XSS) and data injection attacks. How CSP Works CSP is delivered as an HTTP response header: ...