The previous article in this series treated $_SERVER['HTTP_HOST'] and friends as “attacker-controlled territory” and moved on. That’s the right operational answer, but it hides an interesting question: how does a request actually reach your PHP handler in the first place, and which layer decides that Host: attacker.com becomes $_SERVER['HTTP_HOST'] = "attacker.com" in your process? ...
I keep telling new hunters that PHP isn’t a bad language. It’s a language with a few defaults that will eat your lunch if you don’t understand them. After spending most of 2024 and 2025 reviewing WordPress plugin code for paying clients, I’m comfortable saying that roughly half of every PHP CVE I read traces back to three things: ==, $_REQUEST, and the rules PHP uses to convert one type into another. ...
Most of the WordPress, Joomla, and plugin bugs that hit my inbox last year had the same root cause: somebody wrote PHP without understanding how PHP handles types, sessions, or file paths. If you can’t read the buggy code, you can’t write a working exploit. And you definitely can’t tell the customer how to patch it. ...
Platform HASBL CTF 2026 Difficulty Mixed (Easy → Hard) OS Jeopardy — Web (HTTP, nginx, Express, Next.js, Flask) Tags client-side auth bypass via robots.txt + cookie injection, non-iterative path-traversal filter bypass, client-trusted economy / coin spoofing, Next.js sourcemap + header reconnaissance with hint-prune brute force, Jinja2 SSTI in PDF receipts with capped-field escape via Flask SECRET_KEY leak and itsdangerous session forgery HASBL CTF 2026 is a multi-category jeopardy event with Reverse Engineering, Pwn, Web, and Forensics tracks. This writeup is dedicated to the Web Exploitation track — the five web challenges (T/I Forum, Anatolian Atlas, Arena.exe, Lineup Challenge, DTeam) were all solved, and each one teaches a different web-attack primitive: client-side authentication theatre defeated by reading the JavaScript, non-iterative .. traversal filters, client-trusted in-game economies, hint-collection across HTTP headers / sourcemaps / robots.txt, and a two-stage Flask SSTI chain through a PDF-receipt template. ...
The OWASP Top 10 isn’t just a checklist — it’s a snapshot of how real-world breaches happen. The 2021 revision reorganized the previous list around root causes rather than symptoms, which makes it a much better map for both developers and security engineers. This guide walks through each category with reproducible examples, fixes, and detections. ...
Cross-site scripting is twenty-five years old and still topping bug bounty payouts. Modern frameworks make trivial reflected XSS rare — but the bug class evolved, not disappeared. Here’s the 2026 view. The Three Flavors Type Where the payload lives Trigger Reflected URL or form, echoed in response Victim clicks crafted link Stored Database, served back to other users Victim visits an infected page DOM-based Sink in client-side JS reads a source Anything that influences the source Stored XSS is highest impact (often worm-able). DOM XSS dominates modern SPAs because so much state lives in the browser. ...
SQL injection is twenty-five years old and still in the OWASP Top 10. This guide covers detection, exploitation, automation with sqlmap, and modern defenses — with examples that work on real, modern stacks. Detection: The First Tick The classic single-quote test still works against bad code: ...