Security research, writeups, and general notes. Deep technical posts and lighter reads, all in one place. Filter by category below.
A JSON dashboard-import API hid a Java deserialization RCE: a Base64+DEFLATE blob deserialized by a background worker, past a WAF and a serialization filter guarding the wrong service. Confirmed with URLDNS, then escalated to remote code execution.
Where Okta stops and the application starts. A practical black-box methodology for OIDC and SAML integrations: token and assertion validation, direct-origin bypasses, JIT provisioning, and lifecycle drift, with the exact commands to test each boundary.
A hands-on methodology for pentesting apps behind identity-aware proxies: Cloudflare Access, Okta, Entra Application Proxy, Google Cloud IAP, and Zscaler Private Access. Commands, requests, tokens, and a small replay harness for fingerprinting the front door, hunting the origin, breaking JWT…
There is no excerpt because this is a protected post.
A deep security research writeup of two independent remote code execution paths into WildFly application servers: an unauthenticated IIOP/CORBA deserialization flaw, and a jackson-databind polymorphic typing bypass in the web tier. Full technical tracing, discovery story, and working proof of…