- Confirm SSTI fast, then jump straight to RCE A polyglot probe tells you the engine in one shot; from Jinja2 or Freemarker the path to command execution is short.
- XXE through SVG and Office file uploads Any feature that parses SVG, DOCX, or XLSX server side is an XML parser you can feed an external entity to.
- Blind XXE exfiltration with external parameter entities When inline DTDs are blocked and there is no output, an external DTD with parameter entities exfiltrates files over your own channel.
- Single-packet race conditions over HTTP/2 Send 20 to 30 requests in one TCP packet so they hit the same pre-commit window with near-zero jitter.
- Recover a hidden GraphQL schema from field suggestions Introspection off is not the schema hidden; did-you-mean errors leak field and type names one guess at a time.
- Abuse GraphQL aliasing to smash rate limits Aliases let you run the same mutation hundreds of times in one HTTP request, sailing past per-request throttles on OTP or login.
- Detect CL.TE request smuggling without breaking the app A timing-safe CL.TE probe confirms desync by making the front end wait for a body the back end already considers finished.
- Password reset poisoning via unkeyed Host header If the reset email builds its link from the Host header and the CDN does not key on it, you can poison the link or steal…
- Web cache deception on authenticated pages Trick a CDN into caching a victim's private page by appending a static-looking extension the origin ignores but the cache keys on.
- Defeat SSRF allow-lists with DNS rebinding When the server validates a hostname then fetches it separately, a TTL-0 record that flips to an internal IP wins the race between the two lookups.