All Articles & Walkthroughs

When auditing a modern web application, jumping straight into reading the controller code is overwhelming, and it creates context collapse. Line-by-line code analysis often misses misconfigurations, hidden entry points and authorization flows. Adopting a top-down review methodology solves this by bringing a clear, repeatable structure to the entire audit.

File upload features such as profile pictures, document submissions and image galleries are common in modern web applications. They also carry a dangerous threat to the application and server. When the application fully trusts and accepts the file uploads from a user and writes them to a directory, a single misstep can allow an attacker to execute code on the server infrastructure. This article discusses how an attacker can bypass frontend MIME type and extension checks, how polygot files trick image parsers and how to mitigate the file upload vulnerability by isolating the file upload pipeline.

Insecure Direct Object Reference(IDOR) vulnerability arises when the application allows users to access or modify objects that they are not authorized to do so. To exploit the IDOR vulnerability, it does not require an experienced hacker with custom malware or a terminal wizard, it usually just needs a curious user changing a single digit in a URL parameter in their web browser's address bar.