Open note API Security Testing: Finding Vulnerabilities in Modern Web APIs
A practical guide to testing REST APIs for security vulnerabilities, covering authentication bypasses, IDOR, injection attacks, and rate limiting issues.
Field notes / archive
Selected writing
Practical notes on security, software, and the systems that make both possible.
Open note 
Open note Two Captcha Bypasses — IDOR and Token Reuse
Original vulnerability research documenting novel captcha bypass techniques through Insecure Direct Object Reference (IDOR) and authentication token reuse vulnerabilities.
Open note $1,000 CSRF to Full Account Takeover at Verisign (DomainScope)
Responsible disclosure of a $1,000 CSRF in Verisign DomainScope Google OAuth linking — missing state parameter allowed an attacker to link their Google account to a victim's DomainScope profile and take over the account. …