Shellhound / journal
Read the mechanism.
Technical notes for practitioners who want the context behind a tool—not a summary that skips the interesting part.
Timing Attacks on Cryptographic Comparison: Theory and Mitigation
An engineering-focused analysis of timing side-channel attacks on string comparisons, showing how non-constant-time comparison operators compromise secrets, and how to implement constant-time algorithms.
OAuth 2.0 Implicit Flow: Mechanics of Vulnerability and Exploitation
A deep-dive into the security flaws of the OAuth 2.0 Implicit Flow, detailing token leakage vectors, redirect URI bypasses, state parameter forgery, and why it is deprecated in favor of PKCE.
XSS and Content Security Policy: Bypasses and What Actually Works
CSP is the primary defense against XSS, but misconfiguration and unsafe directives make bypasses common — here's how to write a policy that holds.
Understanding DNS Rebinding Attacks: Mechanics, Exploitation, and Defenses
A deep dive into DNS rebinding attacks, showing how attackers bypass the browser's Same-Origin Policy to scan local networks and access internal APIs, with mitigation strategies.
Understanding the TLS Handshake
A precise walkthrough of the TLS 1.3 handshake — key exchange, authentication, and the cryptographic properties each step establishes.
DNS over HTTPS: What It Fixes, What It Doesn't
DoH encrypts DNS queries in transit, but the privacy guarantees are narrower than the marketing implies — here's an honest analysis.
SQL Injection in 2026: Modern Defenses and Where They Break
SQLi hasn't gone away — it's adapted. This post examines how modern ORM abstractions, prepared statements, and WAFs hold up against real attack patterns.
How JWT Authentication Works
A deep-dive into JWT structure, signature verification, and the attack vectors that break implementations in production.