Web Hacking → More Techniques
SPAs push a huge surface into the browser, and every server-side mental model breaks on the way. Route guards aren't auth, tokens …
XSS is just a foothold — BeEF turns the hooked browser into a remote-controlled pivot. Hook.js polling, command modules, fingerpri…
How one missing __proto__ check in lodash.merge turns user-supplied JSON into RCE on every Node service downstream of it. The Java…
A browser feature that bypasses SOP, CORS and most WAFs the moment the 101 lands. The HTTP→WS handshake byte by byte, then Cross-S…
Deep-dive into prototype pollution vulnerabilities — from __proto__ chain mechanics to full RCE via EJS, Pug, and Express gadget c…
Modern race condition exploitation — single-packet HTTP/2 attacks with Turbo Intruder, payment bypass, OTP brute force, TOCTOU fil…
Deep technical guide to software supply chain attacks — dependency confusion, malicious npm postinstall scripts, GitHub Actions in…
Complete WAF bypass methodology — fingerprinting, encoding tricks, HPP, chunked transfer bypass, ModSecurity evasion, Cloudflare/A…
Deep technical guide to XS-Leak browser side-channel attacks — timing oracles, frame counting, error-based oracles, cache timing, …