Web Application Security

Requests, responses, methods, status codes and headers — the foundation every web attack builds on.

How attacker-controlled input becomes executable JavaScript in a victim’s browser — and how to prove it.

When user input is concatenated into a query, an attacker can rewrite the query itself — reading or destroying the database.

When the app forgets to check who you are — the #1 category on the OWASP Top 10.

Make the server make requests for you — into the cloud metadata service and internal network.