API Security on

APISEC-CON CTF – Exception Excavation & Render Bender

Sun, 18 May 2025 00:00:00 +0000

0x00 – The Setup
#

API challenges always make me pause. They’re subtle, often logic-based, and prone to mishandling by developers chasing “RESTful perfection.” When I saw two challenges dropped back-to-back—Exception Excavation and Render Bender—I knew there was potential for mischief.

Coffee, Curiosity & an API – JWT 'alg:none' Exploit in HealthTrack

Mon, 19 Feb 2024 00:00:00 +0000

Prologue: Coffee, Curiosity & an API
#

It was one of those quiet February evenings. No caffeine left in the mug, but my curiosity was wide awake. The glow from the screen illuminated my desk, casting a soft digital haze. I was drifting through recon mode—scrolling API docs, poking endpoints, intercepting calls like I was casually flipping through a dusty book in a forgotten archive.

Broken Authentication: Uncovering Twitter's OAuth Vulnerability

Fri, 07 Apr 2023 00:00:00 +0000

A technical deep dive into an authentication vulnerability in Twitter’s legacy API that allowed bypassing signature validation, exposing user data through inconsistent OAuth enforcement.