corpus.blog
41554 blogs · [ { "id": "01a0d58c-721c-72f4-9bcc-d7baa9cffb23", "title": "One Tap Too Far: Using Shortcuts to Bypass Chrome for iOS Call Prompts", "url": "https://blog.doyensec.com/2026/09/24/chrome-ios-policy-bypass.html", "published_at": "2026-09-23T22:00:00+00:00" }, { "id": "01a0d58c-721c-72f4-9bcc-d7baaa1cc55d", "title": "The skb that wasn't freed - the Fragnesia primitive via Open vSwitch", "url": "https://blog.doyensec.com/2026/09/17/ovs.html", "published_at": "2026-09-16T22:00:00+00:00" }, { "id": "01a08c7a-fb3d-72ec-809e-0261180f5dd1", "title": "Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability", "url": "https://blog.doyensec.com/2026/09/10/oneplus-session-takeover.html", "published_at": "2026-09-09T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81075f120614", "title": "Introducing Session Switcher. Swap Burp Sessions with One Click!", "url": "https://blog.doyensec.com/2026/06/17/session-switcher.html", "published_at": "2026-06-16T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81075f8f1b69", "title": "Comparing AI Application Security Testing Platforms", "url": "https://blog.doyensec.com/2026/05/27/aikido-xbow.html", "published_at": "2026-05-26T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810760186797", "title": "Navigating Lax Load Balancers: When an Intersection Gets You Inside", "url": "https://blog.doyensec.com/2026/05/25/cloudsectidbits-elbaph-alb.html", "published_at": "2026-05-24T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076061097e", "title": "When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax", "url": "https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html", "published_at": "2026-05-18T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107608bc4cf", "title": "The Danger of Multi-SSO AWS Cognito User Pools", "url": "https://blog.doyensec.com/2026/05/05/cloudsectidbits-masso-cognito-sso.html", "published_at": "2026-05-04T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810760f50f98", "title": "CFITSIO Fuzzing: Memory Corruptions and a Codex-Assisted Pipeline", "url": "https://blog.doyensec.com/2026/04/20/cfitsio-fuzzing.html", "published_at": "2026-04-19T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076109afe0", "title": "The MCP AuthN/Z Nightmare", "url": "https://blog.doyensec.com/2026/03/05/mcp-nightmare.html", "published_at": "2026-03-04T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810761670bfa", "title": "Building a Secure Electron Auto-Updater", "url": "https://blog.doyensec.com/2026/02/16/electron-safe-updater.html", "published_at": "2026-02-15T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076227d55a", "title": "Auditing Outline. Firsthand lessons from comparing manual testing and AI security platforms", "url": "https://blog.doyensec.com/2026/02/03/outline-audit-q32025.html", "published_at": "2026-02-02T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107623f0ec8", "title": "Intercepting OkHttp at Runtime With Frida - A Practical Guide", "url": "https://blog.doyensec.com/2026/01/22/frida-instrumentation.html", "published_at": "2026-01-21T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810762c5e834", "title": "InQL v6.1.0 Just Landed with New Features and Contribution Swag! 🚀", "url": "https://blog.doyensec.com/2025/12/02/inql-v610.html", "published_at": "2025-12-01T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810763bb3b68", "title": "ksmbd - Exploiting CVE-2025-37947 (3/3)", "url": "https://blog.doyensec.com/2025/10/08/ksmbd-3.html", "published_at": "2025-10-07T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810763daee47", "title": "Yet Another Random Story: VBScript's Randomize Internals", "url": "https://blog.doyensec.com/2025/09/25/yet-another-random-story.html", "published_at": "2025-09-24T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076406576a", "title": "ksmbd - Fuzzing Improvements and Vulnerability Discovery (2/3)", "url": "https://blog.doyensec.com/2025/09/02/ksmbd-2.html", "published_at": "2025-09-01T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076438bf68", "title": "Trivial C# Random Exploitation", "url": "https://blog.doyensec.com/2025/08/19/trivial-exploit-on-C-random.html", "published_at": "2025-08-18T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076463ce36", "title": "SCIM Hunting - Beyond SSO", "url": "https://blog.doyensec.com/2025/05/08/scim-hunting.html", "published_at": "2025-05-07T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810764e4cc67", "title": "CSPT Resources", "url": "https://blog.doyensec.com/2025/03/27/cspt-resources.html", "published_at": "2025-03-26T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810765e149e5", "title": "!exploitable Episode Three - Devfile Adventures", "url": "https://blog.doyensec.com/2025/03/18/exploitable-gitlab.html", "published_at": "2025-03-17T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076686af0e", "title": "!exploitable Episode Two - Enter the Matrix", "url": "https://blog.doyensec.com/2025/02/27/exploitable-sshd.html", "published_at": "2025-02-26T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810767498363", "title": "!exploitable Episode One - Breaking IoT", "url": "https://blog.doyensec.com/2025/02/11/exploitable-iot.html", "published_at": "2025-02-10T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107678e362b", "title": "Common OAuth Vulnerabilities", "url": "https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html", "published_at": "2025-01-29T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810767e7a6b6", "title": "Bypassing File Upload Restrictions To Exploit Client-Side Path Traversal", "url": "https://blog.doyensec.com/2025/01/09/cspt-file-upload.html", "published_at": "2025-01-08T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076842c2e5", "title": "ksmbd vulnerability research", "url": "https://blog.doyensec.com/2025/01/07/ksmbd-1.html", "published_at": "2025-01-06T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107693bab4a", "title": "Unsafe Archive Unpacking: Labs and Semgrep Rules", "url": "https://blog.doyensec.com/2024/12/16/unsafe-unpacking.html", "published_at": "2024-12-15T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107694d9d5d", "title": "CSPT the Eval Villain Way!", "url": "https://blog.doyensec.com/2024/12/03/cspt-with-eval-villain.html", "published_at": "2024-12-02T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810769bd0526", "title": "Class Pollution in Ruby: A Deep Dive into Exploiting Recursive Merges", "url": "https://blog.doyensec.com/2024/10/02/class-pollution-ruby.html", "published_at": "2024-10-01T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076a684ecf", "title": "Applying Security Engineering to Make Phishing Harder - A Case Study", "url": "https://blog.doyensec.com/2024/09/19/phishing-case-study.html", "published_at": "2024-09-18T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076acc15cd", "title": "Windows Installer, Exploiting Custom Actions", "url": "https://blog.doyensec.com/2024/07/18/custom-actions.html", "published_at": "2024-07-17T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076b4f9192", "title": "A Race to the Bottom - Database Transactions Undermining Your AppSec", "url": "https://blog.doyensec.com/2024/07/11/database-race-conditions.html", "published_at": "2024-07-10T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076b7ba99b", "title": "Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRF", "url": "https://blog.doyensec.com/2024/07/02/cspt2csrf.html", "published_at": "2024-07-01T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076bd6496c", "title": "Single Sign-On Or Single Point of Failure?", "url": "https://blog.doyensec.com/2024/06/20/compromised-idp.html", "published_at": "2024-06-19T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076c59718b", "title": "Product Security Audits vs. Bug Bounty", "url": "https://blog.doyensec.com/2024/05/02/products-security-audit-vs-bugbounty.html", "published_at": "2024-05-01T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076d405641", "title": "Internship Experiences at Doyensec", "url": "https://blog.doyensec.com/2024/03/22/summer-internship-2023.html", "published_at": "2024-03-21T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076e28ddee", "title": "A Look at Software Composition Analysis", "url": "https://blog.doyensec.com/2024/03/14/supplychain.html", "published_at": "2024-03-13T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076e2c3236", "title": "Unveiling the Prototype Pollution Gadgets Finder", "url": "https://blog.doyensec.com/2024/02/17/server-side-prototype-pollution-Gadgets-scanner.html", "published_at": "2024-02-16T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076e8e6d3d", "title": "Introducing PoIEx - Points Of Intersection Explorer", "url": "https://blog.doyensec.com/2024/01/30/poiex-release.html", "published_at": "2024-01-29T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076f1f4fe2", "title": "Kubernetes Scheduling And Secure Design", "url": "https://blog.doyensec.com/2024/01/23/k8s-scheduling-secure-design.html", "published_at": "2024-01-22T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076f30734d", "title": "Office Documents Poisoning in SHVE", "url": "https://blog.doyensec.com/2023/11/03/Office-Document-Poisoning.html", "published_at": "2023-11-02T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076f4d7bd1", "title": "Client-side JavaScript Instrumentation", "url": "https://blog.doyensec.com/2023/09/25/clientside-javascript-instrumentation.html", "published_at": "2023-09-24T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81076f716a00", "title": "Introducing Session Hijacking Visual Exploitation (SHVE): An Innovative Open-Source Tool for XSS Exploitation", "url": "https://blog.doyensec.com/2023/08/31/introducing-session-hijacking-visual-exploitation.html", "published_at": "2023-08-30T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810770195e13", "title": "InQL v5: A Technical Deep Dive", "url": "https://blog.doyensec.com/2023/08/17/inql-v5.html", "published_at": "2023-08-16T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81077020f97a", "title": "Huawei Theme Manager Arbitrary Code Execution", "url": "https://blog.doyensec.com/2023/07/26/huawei-theme-arbitrary-code-exec.html", "published_at": "2023-07-25T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107711d4296", "title": "Streamlining Websocket Pentesting with wsrepl", "url": "https://blog.doyensec.com/2023/07/18/streamlining-websocket-pentesting-with-wsrepl.html", "published_at": "2023-07-17T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107719ce23a", "title": "Messing Around With AWS Batch For Privilege Escalations", "url": "https://blog.doyensec.com/2023/06/13/messing-around-with-aws-batch-for-privilege-escalations.html", "published_at": "2023-06-12T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810771bc45c6", "title": "Logistics for a Remote Company", "url": "https://blog.doyensec.com/2023/06/06/logistics.html", "published_at": "2023-06-05T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81077219378c", "title": "Reversing Pickles with r2pickledec", "url": "https://blog.doyensec.com/2023/06/01/r2pickledec.html", "published_at": "2023-05-31T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-8107723d8a61", "title": "Testing Zero Touch Production Platforms and Safe Proxies", "url": "https://blog.doyensec.com/2023/05/04/testing-ztp-platforms-a-primer.html", "published_at": "2023-05-03T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810773241a46", "title": "The Case For Improving Crypto Wallet Security", "url": "https://blog.doyensec.com/2023/03/28/wallet-info.html", "published_at": "2023-03-27T22:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810774183f92", "title": "Windows Installer EOP (CVE-2023-21800)", "url": "https://blog.doyensec.com/2023/03/21/windows-installer.html", "published_at": "2023-03-20T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81077478a737", "title": "SSRF Cross Protocol Redirect Bypass", "url": "https://blog.doyensec.com/2023/03/16/ssrf-remediation-bypass.html", "published_at": "2023-03-15T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-81077488795a", "title": "A New Vector For “Dirty” Arbitrary File Write to RCE", "url": "https://blog.doyensec.com/2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html", "published_at": "2023-02-27T23:00:00+00:00" }, { "id": "01a07df1-b466-7044-8af4-810774e3bf93", "title": "Introducing Proxy Enriched Sequence Diagrams (PESD)", "url": "https://blog.doyensec.com/2023/02/14/pesd-extension-public-release.html", "published_at": "2023-02-13T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0a4df32c", "title": "Tampering User Attributes In AWS Cognito User Pools", "url": "https://blog.doyensec.com/2023/01/24/tampering-unrestricted-user-attributes-aws-cognito.html", "published_at": "2023-01-23T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0ae446e3", "title": "ImageMagick Security Policy Evaluator", "url": "https://blog.doyensec.com/2023/01/10/imagemagick-security-policy-evaluator.html", "published_at": "2023-01-09T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0b52171e", "title": "safeurl for Go", "url": "https://blog.doyensec.com/2022/12/13/safeurl.html", "published_at": "2022-12-12T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0bcb82ca", "title": "Let's speak AJP", "url": "https://blog.doyensec.com/2022/11/15/learning-ajp.html", "published_at": "2022-11-14T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0c576473", "title": "Recruiting Security Researchers Remotely", "url": "https://blog.doyensec.com/2022/11/09/recruiting-security-researchers.html", "published_at": "2022-11-08T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0ca53939", "title": "Visual Studio Code Jupyter Notebook RCE", "url": "https://blog.doyensec.com/2022/10/27/jupytervscode.html", "published_at": "2022-10-26T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0d337476", "title": "The Danger of Falling to System Role in AWS SDK Client", "url": "https://blog.doyensec.com/2022/10/18/cloudsectidbit-dataimport.html", "published_at": "2022-10-17T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0d74022d", "title": "On Bypassing eBPF Security Monitoring", "url": "https://blog.doyensec.com/2022/10/11/ebpf-bypass-security-monitoring.html", "published_at": "2022-10-10T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0e4ba2a9", "title": "Comparing Semgrep and CodeQL", "url": "https://blog.doyensec.com/2022/10/06/semgrep-codeql.html", "published_at": "2022-10-05T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0ece39b3", "title": "Diving Into Electron Web API Permissions", "url": "https://blog.doyensec.com/2022/09/27/electron-api-default-permissions.html", "published_at": "2022-09-26T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0eeb28dc", "title": "ElectroNG, our premium SAST tool released!", "url": "https://blog.doyensec.com/2022/09/06/electrong-launch.html", "published_at": "2022-09-05T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0f99c9be", "title": "My Internship Experience at Doyensec", "url": "https://blog.doyensec.com/2022/08/24/intern-experience.html", "published_at": "2022-08-23T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d0ffabefe", "title": "Dependency Confusion", "url": "https://blog.doyensec.com/2022/07/21/dependency-confusion.html", "published_at": "2022-07-20T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d10659567", "title": "Apache Pinot SQLi and RCE Cheat Sheet", "url": "https://blog.doyensec.com/2022/06/09/apache-pinot-sqli-rce.html", "published_at": "2022-06-08T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d112f5136", "title": "Introduction to VirtualBox security research", "url": "https://blog.doyensec.com/2022/04/26/vbox-fuzzing.html", "published_at": "2022-04-25T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d11ff5bf0", "title": "H1.Jack, The Game", "url": "https://blog.doyensec.com/2022/02/16/h1jack-the-game.html", "published_at": "2022-02-15T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d125a2080", "title": "That single GraphQL issue that you keep missing", "url": "https://blog.doyensec.com/2021/05/20/graphql-csrf.html", "published_at": "2021-05-19T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d12c681ad", "title": "Regexploit: DoS-able Regular Expressions", "url": "https://blog.doyensec.com/2021/03/11/regexploit.html", "published_at": "2021-03-10T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d13395821", "title": "Electron APIs Misuse: An Attacker’s First Choice", "url": "https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html", "published_at": "2021-02-15T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d13a0ff67", "title": "Psychology of Remote Work", "url": "https://blog.doyensec.com/2020/12/17/psychology-of-remote-work.html", "published_at": "2020-12-16T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d141c7ae0", "title": "Novel Abuses On Wi-Fi Direct Mobile File Transfers", "url": "https://blog.doyensec.com/2020/12/10/novel-abuses-wifi-direct-mobile-file-transfers.html", "published_at": "2020-12-09T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d14e76605", "title": "InQL Scanner v3 - Just Released!", "url": "https://blog.doyensec.com/2020/11/19/inql-scanner-v3.html", "published_at": "2020-11-18T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d153e15c5", "title": "Fuzzing JavaScript Engines with Fuzzilli", "url": "https://blog.doyensec.com/2020/09/09/fuzzilli-jerryscript.html", "published_at": "2020-09-08T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d15cdfc99", "title": "CSRF Protection Bypass in Play Framework", "url": "https://blog.doyensec.com/2020/08/20/playframework-csrf-bypass.html", "published_at": "2020-08-19T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1601dd84", "title": "InQL Scanner v2 is out!", "url": "https://blog.doyensec.com/2020/06/11/inql-scanner-v2.html", "published_at": "2020-06-10T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d16480715", "title": "Fuzzing TLS certificates from their ASN.1 grammar", "url": "https://blog.doyensec.com/2020/05/14/asn1fuzz.html", "published_at": "2020-05-13T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d17259b05", "title": "Researching Polymorphic Images for XSS on Google Scholar", "url": "https://blog.doyensec.com/2020/04/30/polymorphic-images-for-xss.html", "published_at": "2020-04-29T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d174d9580", "title": "LibreSSL and OSS-Fuzz", "url": "https://blog.doyensec.com/2020/04/08/libressl-fuzzer.html", "published_at": "2020-04-07T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d17b92dc6", "title": "InQL Scanner", "url": "https://blog.doyensec.com/2020/03/26/graphql-scanner.html", "published_at": "2020-03-25T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d17dcf81a", "title": "Don't Clone That Repo: Visual Studio Code^2 Execution", "url": "https://blog.doyensec.com/2020/03/16/vscode_codeexec.html", "published_at": "2020-03-15T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1846c9b5", "title": "2019 Gravitational Security Audit Results", "url": "https://blog.doyensec.com/2020/03/02/gravitational-audit.html", "published_at": "2020-03-01T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d18b0f792", "title": "Signature Validation Bypass Leading to RCE In Electron-Updater", "url": "https://blog.doyensec.com/2020/02/24/electron-updater-update-signature-bypass.html", "published_at": "2020-02-23T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d191bca8b", "title": "Security Analysis of the Solo Firmware", "url": "https://blog.doyensec.com/2020/02/19/solokeys-audit.html", "published_at": "2020-02-18T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d19ac226d", "title": "Heap Overflow in F-Secure Internet Gatekeeper", "url": "https://blog.doyensec.com/2020/02/03/heap-exploit.html", "published_at": "2020-02-02T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1aa49abb", "title": "Internship at Doyensec", "url": "https://blog.doyensec.com/2019/11/05/internship-at-doyensec.html", "published_at": "2019-11-04T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1aafb3c3", "title": "One Bug To Rule Them All: Modern Android Password Managers and FLAG_SECURE Misuse", "url": "https://blog.doyensec.com/2019/08/22/modern-password-managers-flag-secure.html", "published_at": "2019-08-21T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1b3d3f0d", "title": "Lessons in auditing cryptocurrency wallets, systems, and infrastructures", "url": "https://blog.doyensec.com/2019/08/01/common-crypto-bugs.html", "published_at": "2019-07-31T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1b7133fa", "title": "Jackson gadgets - Anatomy of a vulnerability", "url": "https://blog.doyensec.com/2019/07/22/jackson-gadgets.html", "published_at": "2019-07-21T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1bc6223d", "title": "Electron Security Workshop", "url": "https://blog.doyensec.com/2019/07/03/electron-security-workshop.html", "published_at": "2019-07-02T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1bf42ef2", "title": "Electronegativity 1.3.0 released!", "url": "https://blog.doyensec.com/2019/06/11/electronegativity-1.3.html", "published_at": "2019-06-10T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1ca741d8", "title": "On insecure zip handling, Rubyzip and Metasploit RCE (CVE-2019-5624)", "url": "https://blog.doyensec.com/2019/04/24/rubyzip-bug.html", "published_at": "2019-04-23T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1d28ed33", "title": "Subverting Electron Apps via Insecure Preload", "url": "https://blog.doyensec.com/2019/04/03/subverting-electron-apps-via-insecure-preload.html", "published_at": "2019-04-02T22:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1d66f240", "title": "Electronegativity is finally out!", "url": "https://blog.doyensec.com/2019/01/24/electronegativity.html", "published_at": "2019-01-23T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1e5731df", "title": "Introducing burp-rest-api v2", "url": "https://blog.doyensec.com/2018/11/05/burp-rest-api-v2.html", "published_at": "2018-11-04T23:00:00+00:00" }, { "id": "01a07df1-b467-7101-8ee1-081d1e8b6db2", "title": "Instrumenting Electron Apps for Security Testing", "url": "https://blog.doyensec.com/2018/07/19/instrumenting-electron-app.html", "published_at": "2018-07-18T22:00:00+00:00" } ] posts Claim your blog
Back to Doyensec Blog
Blog · corpus.blog/blogs/blog.doyensec.com/posts

Doyensec Blog

blog.doyensec.com

2026

One Tap Too Far: Using Shortcuts to Bypass Chrome for iOS Call Promptsoriginal ↗
23 Sept 2026
The skb that wasn't freed - the Fragnesia primitive via Open vSwitchoriginal ↗
16 Sept 2026
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerabilityoriginal ↗
9 Sept 2026
Introducing Session Switcher. Swap Burp Sessions with One Click!original ↗
16 Jun 2026
Comparing AI Application Security Testing Platformsoriginal ↗
26 May 2026
Navigating Lax Load Balancers: When an Intersection Gets You Insideoriginal ↗
24 May 2026
When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntaxoriginal ↗
18 May 2026
The Danger of Multi-SSO AWS Cognito User Poolsoriginal ↗
4 May 2026
CFITSIO Fuzzing: Memory Corruptions and a Codex-Assisted Pipelineoriginal ↗
19 Apr 2026
The MCP AuthN/Z Nightmareoriginal ↗
4 Mar 2026
Building a Secure Electron Auto-Updateroriginal ↗
15 Feb 2026
Auditing Outline. Firsthand lessons from comparing manual testing and AI security platformsoriginal ↗
2 Feb 2026
Intercepting OkHttp at Runtime With Frida - A Practical Guideoriginal ↗
21 Jan 2026

2025

InQL v6.1.0 Just Landed with New Features and Contribution Swag! 🚀original ↗
1 Dec 2025
ksmbd - Exploiting CVE-2025-37947 (3/3)original ↗
7 Oct 2025
Yet Another Random Story: VBScript's Randomize Internalsoriginal ↗
24 Sept 2025
ksmbd - Fuzzing Improvements and Vulnerability Discovery (2/3)original ↗
1 Sept 2025
Trivial C# Random Exploitationoriginal ↗
18 Aug 2025
SCIM Hunting - Beyond SSOoriginal ↗
7 May 2025
CSPT Resourcesoriginal ↗
26 Mar 2025
!exploitable Episode Three - Devfile Adventuresoriginal ↗
17 Mar 2025
!exploitable Episode Two - Enter the Matrixoriginal ↗
26 Feb 2025
!exploitable Episode One - Breaking IoToriginal ↗
10 Feb 2025
Common OAuth Vulnerabilitiesoriginal ↗
29 Jan 2025
Bypassing File Upload Restrictions To Exploit Client-Side Path Traversaloriginal ↗
8 Jan 2025
ksmbd vulnerability researchoriginal ↗
6 Jan 2025

2024

Unsafe Archive Unpacking: Labs and Semgrep Rulesoriginal ↗
15 Dec 2024
CSPT the Eval Villain Way!original ↗
2 Dec 2024
Class Pollution in Ruby: A Deep Dive into Exploiting Recursive Mergesoriginal ↗
1 Oct 2024
Applying Security Engineering to Make Phishing Harder - A Case Studyoriginal ↗
18 Sept 2024
Windows Installer, Exploiting Custom Actionsoriginal ↗
17 Jul 2024
A Race to the Bottom - Database Transactions Undermining Your AppSecoriginal ↗
10 Jul 2024
Exploiting Client-Side Path Traversal to Perform Cross-Site Request Forgery - Introducing CSPT2CSRForiginal ↗
1 Jul 2024
Single Sign-On Or Single Point of Failure?original ↗
19 Jun 2024
Product Security Audits vs. Bug Bountyoriginal ↗
1 May 2024
Internship Experiences at Doyensecoriginal ↗
21 Mar 2024
A Look at Software Composition Analysisoriginal ↗
13 Mar 2024
Unveiling the Prototype Pollution Gadgets Finderoriginal ↗
16 Feb 2024
Introducing PoIEx - Points Of Intersection Exploreroriginal ↗
29 Jan 2024
Kubernetes Scheduling And Secure Designoriginal ↗
22 Jan 2024

2023

Office Documents Poisoning in SHVEoriginal ↗
2 Nov 2023
Client-side JavaScript Instrumentationoriginal ↗
24 Sept 2023
Introducing Session Hijacking Visual Exploitation (SHVE): An Innovative Open-Source Tool for XSS Exploitationoriginal ↗
30 Aug 2023
InQL v5: A Technical Deep Diveoriginal ↗
16 Aug 2023
Huawei Theme Manager Arbitrary Code Executionoriginal ↗
25 Jul 2023
Streamlining Websocket Pentesting with wsreploriginal ↗
17 Jul 2023
Messing Around With AWS Batch For Privilege Escalationsoriginal ↗
12 Jun 2023
Logistics for a Remote Companyoriginal ↗
5 Jun 2023
Reversing Pickles with r2pickledecoriginal ↗
31 May 2023
Testing Zero Touch Production Platforms and Safe Proxiesoriginal ↗
3 May 2023
The Case For Improving Crypto Wallet Securityoriginal ↗
27 Mar 2023
Windows Installer EOP (CVE-2023-21800)original ↗
20 Mar 2023
SSRF Cross Protocol Redirect Bypassoriginal ↗
15 Mar 2023
A New Vector For “Dirty” Arbitrary File Write to RCEoriginal ↗
27 Feb 2023
Introducing Proxy Enriched Sequence Diagrams (PESD)original ↗
13 Feb 2023
Tampering User Attributes In AWS Cognito User Poolsoriginal ↗
23 Jan 2023
ImageMagick Security Policy Evaluatororiginal ↗
9 Jan 2023

2022

safeurl for Gooriginal ↗
12 Dec 2022
Let's speak AJPoriginal ↗
14 Nov 2022
Recruiting Security Researchers Remotelyoriginal ↗
8 Nov 2022
Visual Studio Code Jupyter Notebook RCEoriginal ↗
26 Oct 2022
The Danger of Falling to System Role in AWS SDK Clientoriginal ↗
17 Oct 2022
On Bypassing eBPF Security Monitoringoriginal ↗
10 Oct 2022
Comparing Semgrep and CodeQLoriginal ↗
5 Oct 2022
Diving Into Electron Web API Permissionsoriginal ↗
26 Sept 2022
ElectroNG, our premium SAST tool released!original ↗
5 Sept 2022
My Internship Experience at Doyensecoriginal ↗
23 Aug 2022
Dependency Confusionoriginal ↗
20 Jul 2022
Apache Pinot SQLi and RCE Cheat Sheetoriginal ↗
8 Jun 2022
Introduction to VirtualBox security researchoriginal ↗
25 Apr 2022
H1.Jack, The Gameoriginal ↗
15 Feb 2022

2021

That single GraphQL issue that you keep missingoriginal ↗
19 May 2021
Regexploit: DoS-able Regular Expressionsoriginal ↗
10 Mar 2021
Electron APIs Misuse: An Attacker’s First Choiceoriginal ↗
15 Feb 2021

2020

Psychology of Remote Workoriginal ↗
16 Dec 2020
Novel Abuses On Wi-Fi Direct Mobile File Transfersoriginal ↗
9 Dec 2020
InQL Scanner v3 - Just Released!original ↗
18 Nov 2020
Fuzzing JavaScript Engines with Fuzzillioriginal ↗
8 Sept 2020
CSRF Protection Bypass in Play Frameworkoriginal ↗
19 Aug 2020
InQL Scanner v2 is out!original ↗
10 Jun 2020
Fuzzing TLS certificates from their ASN.1 grammaroriginal ↗
13 May 2020
Researching Polymorphic Images for XSS on Google Scholaroriginal ↗
29 Apr 2020
LibreSSL and OSS-Fuzzoriginal ↗
7 Apr 2020
InQL Scanneroriginal ↗
25 Mar 2020
Don't Clone That Repo: Visual Studio Code^2 Executionoriginal ↗
15 Mar 2020
2019 Gravitational Security Audit Resultsoriginal ↗
1 Mar 2020
Signature Validation Bypass Leading to RCE In Electron-Updateroriginal ↗
23 Feb 2020
Security Analysis of the Solo Firmwareoriginal ↗
18 Feb 2020
Heap Overflow in F-Secure Internet Gatekeeperoriginal ↗
2 Feb 2020

2019

Internship at Doyensecoriginal ↗
4 Nov 2019
One Bug To Rule Them All: Modern Android Password Managers and FLAG_SECURE Misuseoriginal ↗
21 Aug 2019
Lessons in auditing cryptocurrency wallets, systems, and infrastructuresoriginal ↗
31 Jul 2019
Jackson gadgets - Anatomy of a vulnerabilityoriginal ↗
21 Jul 2019
Electron Security Workshoporiginal ↗
2 Jul 2019
Electronegativity 1.3.0 released!original ↗
10 Jun 2019
On insecure zip handling, Rubyzip and Metasploit RCE (CVE-2019-5624)original ↗
23 Apr 2019
Subverting Electron Apps via Insecure Preloadoriginal ↗
2 Apr 2019
Electronegativity is finally out!original ↗
23 Jan 2019

2018

Introducing burp-rest-api v2original ↗
4 Nov 2018
Instrumenting Electron Apps for Security Testingoriginal ↗
18 Jul 2018
Next