AST04 of the OWASP Agentic Skills Top 10: skill metadata is attacker-controlled input - brand impersonation, permission understating, risk-tier spoofing, invisible-character injections, and YAML !!python/object deserialization that executes code at parse time, before approval. Safe-parser and schema controls explained.
AST03 of the OWASP Agentic Skills Top 10: the risk where nothing is malicious and the damage still lands. Permission checks fire at tool-call level, not intent - so a SELECT-permitted skill can DROP TABLE. With Meta's inbox-deletion incident, LPCI and LAAF research, and the per-skill credential controls that close the gap.
Complete cross-site scripting (XSS) tutorial covering stored, reflected, and DOM-based XSS with practical exploitation examples and prevention strategies including CSP.
A deep dive into Server-Side Template Injection (SSTI) — how template engines turn attacker input into RCE, with discovery, exploitation and defense patterns.
XXE Injection remains one of the most dangerous web vulnerabilities, allowing attackers to read server files, execute SSRF, and even achieve remote code execution. Master in-band, out-of-band, and blind XXE techniques with practical payload examples.
Your front end and your back end disagree about where one request ends and the next begins. The smuggled prefix slides under the WAF, defeats the rate limiter, and poisons the cache under someone else else URL. How CL-TE and TE-CL desyncs work, and the configuration discipline that closes them.
One curl request to /.git/HEAD hands attackers your full source, every commit ever made, deleted files, and usually a working credential. A decade of research says this mistake is not aging out. Here is the exploit chain — and the three-layer fix.
In-depth guide to HTTP request smuggling attacks. Learn how to exploit discrepancies between frontend proxies and backend servers in both HTTP/1.1 and HTTP/2 environments with practical examples.
A practical analysis of API security authorization flaws behind modern breaches. Covers BOLA, BFLA, IDOR, mass assignment, shadow APIs, and defense strategies for API-first architectures.
Comprehensive guide to securing login and registration systems. Covers authentication vulnerabilities, brute-force protection, session management, CAPTCHA implementation, and security best practices.
CORS misconfigurations rank among the most critical web security vulnerabilities in modern applications. Learn how to identify, exploit, and remediate cross-origin resource sharing flaws including origin reflection, null origin trust, and subdomain bypass techniques.
Learn error-based exploitation techniques used by pentesters to extract sensitive data from vulnerable applications. Covers SQL injection, SSTI, and other injection-based attacks with practical examples and mitigation strategies.