Overview Evergreen Property Management provided a resident tenant portal for users to manage their accounts and view property-related information. During testing, the application issued a JWT-base...

GraphQL Introspection and Sensitive Data Exposure | Ottergram Overview While testing Ottergram, the application was found using a GraphQL backend for handling user-related functionality. GraphQL...

UUID-Based IDOR Through Member API | Apex Fitness Overview Apex Fitness migrated its member portal from sequential numeric IDs to UUID-based identifiers believing this would eliminate IDOR vulner...

Predictable Time-Based Auth Token Leading to Authentication Bypass | Sokudo Overview Sokudo is a typing speed platform that used a custom authentication mechanism for accessing authenticated func...

Overview SunnySide was a daycare enrollment platform that allowed parents to submit inquiries for childcare programs through an online registration form. During testing, the /enroll endpoint was ...

Overview This lab demonstrated a critical flaw in session management where the application used a predictable authentication mechanism for session tokens. Instead of generating cryptographically ...

Overview While exploring the application’s functionality, I discovered a feature that allowed users to import custom flashcard decks. The import page accepted uploaded deck files and also provide...

Overview Password reset mechanisms are a high-value target in web applications. If implemented incorrectly, they can allow attackers to bypass authentication entirely. In this lab, the OTP verifi...

Overview File upload functionality is commonly secured using file extension filtering, where dangerous extensions are blocked. However, blacklist-based filtering is inherently weak. It relies on ...

Overview File upload validation is a critical component of web application security. Many applications attempt to prevent malicious uploads by verifying file signatures (magic bytes). While this ...