← Blog // TAG

Web

3 articles

Red Team How a WAF gets bypassed (and why a blocklist is rarely enough) A blocklist WAF is a speed bump, not a wall: it chases strings, not semantics. The four classic bypasses (XSS without <… Read → Red Team JWT: the 3 flaws I see in every pentest A JWT is readable without a key (it is not encrypted). The three flaws that turn it into full compromise: alg:none, wea… Read → Blue Team CSP in practice: a Content-Security-Policy that stops XSS without breaking your site Most CSPs are useless (with unsafe-inline) or break the site. How to build a strict nonce-based CSP, the directives tha… Read →