Exploiting XXE with local DTD files mohemiv.com

Evil XML with two encodings mohemiv.com

DOS File Path Magic Tricks medium.com

What is going on with OAuth 2.0? And why you should not use it for authentication. medium.com

Web Application Firewall (WAF) Evasion Techniques #2 medium.com

Web Application Firewall (WAF) Evasion Techniques medium.com

PHP SSRF Techniques medium.com

How I got my first big bounty payout with Tesla medium.com

How I hacked Google’s bug tracking system itself for $15,600 in bounties medium.com

XSS-Auditor — the protector of unprotected and the deceiver of protected. medium.com

Piercing the Veil: Server Side Request Forgery to NIPRNet access medium.com

Be careful what you copy: Invisibly inserting usernames into text with Zero-Width Characters medium.com

Making a Blind SQL Injection a little less blind medium.com

Hacking Cryptocurrency Miners with OSINT Techniques medium.com

Clickjackings in Google worth 14981.7$ medium.com

Hacking home routers from the Internet medium.com

How I found a $5,000 Google Maps XSS (by fiddling with Protobuf) medium.com

Wiping Out CSRF medium.com

How to bypass libinjection in many WAF/NGWAF medium.com

Attacking Private Networks from the Internet with DNS Rebinding medium.com

If HttpOnly You Could Still CSRF… Of CORS you can! medium.com

XML Out-Of-Band Data Retrieval media.blackhat.com

MBSD Technical Whitepaper - A few RPO exploitation techniques mbsd.jp

Some Tricks From My Secret Group leavesongs.com

leavesongs leavesongs.com

XSS Cheat Sheet - 2018 Edition leanpub.com

How I exploited ACME TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain using shared hosting labs.detectify.com

CSP: bypassing form-action with reflected XSS labs.detectify.com

Neatly bypassing CSP lab.wallarm.com

Cache poisoning and other dirty tricks lab.wallarm.com

The inception bar: a new phishing method jameshfisher.com

Clickjacking imperva.com

Pentest + Exploit dev Cheatsheet wallpaper i.imgur.com

Hackxor hackxor.net

Rails Security - First part hackmd.io

SSRF in Exchange leads to ROOT access in all instances hackerone.com

Query parameter reordering causes redirect page to render unsafe URL hackerone.com

Sending arbitrary IPC messages via overriding Function.prototype.apply hackerone.com

SSRF in https://imgur.com/vidgif/url hackerone.com

Breaking UC Browser habr.com

Official Rails Security Guide guides.rubyonrails.org

Automating local DTD discovery for XXE exploitation gosecure.ai

Cross-Site Scripting – Application Security – Google google.com

Any protection against dynamic module import? github.com

PayloadsAllTheThings - XXE Injection github.com

PayloadsAllTheThings - XSS Injection github.com

PayloadsAllTheThings - Web Cache Deception github.com

PayloadsAllTheThings - Upload Insecure Files github.com

PayloadsAllTheThings - Server-Side Request Forgery github.com

PayloadsAllTheThings - SQL Injection github.com