Published work tagged AppSec.
A user-agent string names the client on each HTTP request, but anyone can fake it. Here is how to read one, verify Googlebot, and what UA reduction changes.
URL encoding (percent-encoding) turns unsafe characters into %XX. Here is %20 vs +, UTF-8, double encoding, and why validators must decode once first.
Password entropy measures how hard a secret is to guess, in bits. Here is the formula, why Password1! fails it, and how to generate something strong.
A hash is a fixed-length fingerprint of data. Here is how MD5 and SHA-256 differ, why fast hashes are wrong for passwords, and what HMAC adds.
A JWT is a signed bundle of JSON claims. Here is how to read one, why decoding is not verifying, and how to check for the classic JWT security flaws.
Hands-on masterclass on auditing and exploiting GraphQL API vulnerabilities (introspection bypasses, alias rate-limit bypasses, BOLA, depth DoS) with full runna…
