Posts by jomynn
Posts by jomynn
One file path. No form, no captured traffic, no automated finding anywhere in the pipeline. Here's the
full story of a real CWE-611https://cwe.mitre.org/data/definitions/611.html XML External Entity
vulnerability — the first bug in this series where ...
A full walkthrough of finding, proving, and reporting a real SSRF bug with a deterministic rule engine, a live form-based exploit, an attempted and explained automated probe, and a fully offline local LLM — no cloud AI anywhere in the pipeline.
tags:...
The bug
Here's the route from a small Express demo app
scan-target-demo-apps/apps/06-path-traversalhttps://github.com/sendwavehub/scan-target-demo-apps:
app.get'/files', req, res => {
const name = req.query.name;
const filePath = path.joindocs...
One tainted variable. One shell on the host. Here's the full story of a real
CWE-78https://cwe.mitre.org/data/definitions/78.html OS Command
Injection vulnerability, from the moment a rule engine flags it to a
disclosure-ready report — all running lo...
> ⚠️ Educational / authorized testing only. Everything below targets a local, deliberately vulnerable training application, not a live system. Never run these techniques against anything you don't own or don't have explicit written authorization to t...
Most IDOR write-ups stop at "change the ID in the URL and you get someone else's data."
That's the easy part. The part that actually matters — proving it rigorously, ruling out
the boring explanation, and turning it into a report someone can act on —...
How AiSec Studio pipes every scan through parser → rule engine → knowledge graph before a local LLM ever sees it — and why that order matters. 60-second Auto Scan demo included.
Most "AI-powered" security scanners work the same way under the hood: ...
chevron_left