Web 30

• RaceCondition(TOCTOU) with Burp Aug 12, 2025
• os.path.join to LFI Jul 8, 2025
• Front-End Security Mar 3, 2025
• Nginx off by slash Apr 9, 2024
• XSS with srcdoc Mar 22, 2024
• PHAR Deserialization Vulnerability Mar 8, 2024
• HTTP 0.9, 1.0, 1.1, 2.0 Jan 27, 2024
• CSP Bypass with JSONP Dec 7, 2023
• URL Normalization with XSS Dec 7, 2023
• AWS Instance Meta-data SSRF Dec 4, 2023
• ejs RCE Payload Nov 28, 2023
• Prototype Pollution Nov 20, 2023
• Response Status Code(307, 308) with POST DATA Nov 14, 2023
• SS-Leak with Code Injection Nov 14, 2023
• XS-Search Nov 13, 2023
• Privilege elevation by SQL Injection Nov 10, 2023
• SQL Injection Filtering Bypass Nov 10, 2023
• EX - CSS Injection Sep 8, 2023
• php filter chain RCE Aug 25, 2023
• XSS with Fileupload Name Jun 7, 2023
• Cookie Security Jun 7, 2023
• Unicode Lower Case & Decomposition Jun 6, 2023
• CRLF Injection & HTTP Response Splitting May 19, 2023
• URL Check Automation Apr 25, 2023
• Requestbin Development Apr 14, 2023
• SQL Injection Sleep() is Danger.. Mar 23, 2023
• loose comparison Feb 2, 2023
• Blind SQLi With Binary Search & Python Nov 3, 2022
• Blind SQLi With Bit operation & Burp Intruder Oct 22, 2022
• XSS Filtering bypass with JSFuck Oct 17, 2022