Blog
Real attack chains from penetration testing engagements — root causes, remediation, and how to find this class of issue yourself.
May 26, 2025
Compromising an Azure Tenant via XXE OOB and web.config Exfiltration
An exposed API documentation directory, an out-of-band XXE, and Azure App Service path mappings that together exposed a corporate mailbox used for password resets.
XXEAzureOOBCloud SecurityWeb
2025
Authorization Code Interception via Open Redirect in an AWS Cognito OAuth Flow
An unvalidated post-login redirect plus a public Cognito app client combined into an account takeover that required no phishing page and no victim password.
OAuth 2.0AWS CognitoOpen RedirectAccount TakeoverToken Leak
2025
From Zero to Admin: Account Takeover via GraphQL Enumeration and Authorization Bypass
A chain of GraphQL introspection, a leaked OTP, and broken function-level authorization that led to full administrative account takeover from an unauthenticated position.
WebGraphQLBFLAAccount TakeoverAPI Security