Web Security on

JWT Hunt – Iron CTF 2024

Tue, 23 Apr 2024 00:00:00 +0000

0x00 – Prologue
#

I like JWT bugs. They’re like puzzles where you know someone somewhere made a careless design call, and you just have to figure out where the glue fell apart. In this one, the challenge was called “JWT Hunt” and it lived up to the name. Turns out the devs had split the signing key into four parts and sprinkled them around the site like cryptographic breadcrumbs.

The Anatomy of a Clickjacking Vulnerability: A Trello Deep Dive

Wed, 15 Nov 2023 00:00:00 +0000

An exploration of a clickjacking vulnerability found in Trello’s public boards, examining the technical details, potential impacts, and broader security lessons about proper header configurations.

"PetCare" – CSRF in the Admin Panel: When One Click Made You an Admin

Wed, 15 Feb 2023 00:00:00 +0000

A simple POST request without CSRF protection allowed me to trick a PetCare admin into granting me admin privileges. This writeup dives into the exploitation steps, mental process, root cause, and patching of a high-risk vulnerability in their internal panel.

Web Security on

JWT Hunt – Iron CTF 2024

0x00 – Prologue #

The Anatomy of a Clickjacking Vulnerability: A Trello Deep Dive

"PetCare" – CSRF in the Admin Panel: When One Click Made You an Admin

0x00 – Prologue
#