d4d
@zakfedotkin.bsky.social
Zak Fedotkin
All thought are mine and mine alone
All thought are mine and mine alone
For a visual walk‑through, see the @steelcon.info livestream recording: youtu.be/wxu1axAdPhw?...
Cookie Chaos: Exploiting Parser Discrepancies - Zack
YouTube video by SteelCon
youtu.be
September 3, 2025 at 2:56 PM
For a visual walk‑through, see the @steelcon.info livestream recording: youtu.be/wxu1axAdPhw?...
If you missed the original research, you can find it at portswigger.net/research/dra...
Drag and Pwnd: Leverage ASCII characters to exploit VS Code
Control characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do. In this post, I'll dive into the forgotten mechanics
portswigger.net
May 28, 2025 at 3:00 PM
If you missed the original research, you can find it at portswigger.net/research/dra...
Check out the newest version here:
portswigger.net/web-security...
Null byte tricks:
portswigger.net/web-security...
portswigger.net/web-security...
Null byte tricks:
portswigger.net/web-security...
URL validation bypass cheat sheet for SSRF/CORS/Redirect - 2024 Edition | Web Security Academy
This cheat sheet contains payloads for bypassing URL validation. These wordlists are useful for attacks such as server-side request forgery, CORS ...
portswigger.net
March 5, 2025 at 1:35 PM
Check out the newest version here:
portswigger.net/web-security...
Null byte tricks:
portswigger.net/web-security...
portswigger.net/web-security...
Null byte tricks:
portswigger.net/web-security...
Check it out here👇
portswigger.net/web-security...
portswigger.net/web-security...
URL validation bypass cheat sheet for SSRF/CORS/Redirect - 2024 Edition | Web Security Academy
This cheat sheet contains payloads for bypassing URL validation. These wordlists are useful for attacks such as server-side request forgery, CORS ...
portswigger.net
February 6, 2025 at 9:18 AM
Check it out here👇
portswigger.net/web-security...
portswigger.net/web-security...
Ruby secret_key_base can be decrypted from credentials.yml.enc file using following java code:
December 20, 2024 at 2:01 PM
Ruby secret_key_base can be decrypted from credentials.yml.enc file using following java code: