The UnboundCompute blog
How web apps and APIs really break.
Clear, honest writing on web and API security. The common bugs, the ones automated scanners miss, and how a real finding is actually proven. Written for everyone from beginners to security teams.
What we write about
Vulnerability Basics
Plain explanations of how software actually breaks.
Access Control
Broken access control, IDOR, and who can do what.
Injection and Input
XSS, SQL injection, and untrusted input.
Scanners vs Research
Why scanners miss the bugs that matter.
Attack Teardowns
Step by step walkthroughs of real bug classes.
Latest writing
-
Detecting HTTP Request Smuggling Safely
A guide to detecting HTTP request smuggling with timing based probes, differential responses, and teardown that confirms a real desync without poisoning users.
-
Connection State Request Smuggling
How connection state request smuggling works: a front end validates the first request, then reuses that trust and routing for later requests on the connection.
-
Request Tunnelling Attack Explained
A request tunnelling attack opens a direct pipe through the front end to the back end so routing and access rules never inspect the attacker’s second request.
-
Capturing Other Users Requests With a Desync
How capturing other users requests works: smuggle a prefix into a stored and reflected endpoint so a victim’s cookies and body land where you can read them.
-
Request Smuggling WAF Bypass
How a request smuggling WAF bypass works: a blocked request hides in a body the filter reads as data, then the back end parses it as a fresh request it never saw.
-
Request Smuggling Cache Poisoning
How request smuggling cache poisoning works: a desync lets an attacker control what a cache stores, so content is saved under a victim URL and served to all.