SauronSec
Web security, explained simply.
The most common vulnerabilities, described without jargon — what they are, why they matter, and how to protect yourself.
SSRF: making your server speak on someone else’s behalf
If your server fetches a URL supplied by the visitor, an attacker can swap it for an internal address — turning your server into their accomplice.
Read the articleCORS misconfiguration: the door you leave open to every site
CORS is meant to tell a browser which sites may read your data. Misconfigured, it says “yes” to absolutely everyone.
Read the articleJWT: the token that can forge itself
A JWT carries its own signature — but only if the server actually checks it. Some implementations let an attacker bypass it entirely.
Read the articleOS command injection: when a text field talks to the server
Some sites pass a visitor’s text straight to the operating system. An attacker can then run their own commands, not yours.
Read the articleThe security headers your site (almost) always forgets
The browser knows perfectly well how to defend itself — you just have to ask it to. A handful of HTTP headers, free to enable, that block entire families of attacks.
Read the articleCSRF: acting without your knowledge while you’re logged in
You’re logged into a site in one tab. You visit another. If it isn’t protected, your browser can act in your name without you clicking anything.
Read the articleIDOR: when changing one digit in the URL is enough
Invoice, order, profile… if access depends only on a number in the URL, changing that number can be enough to read someone else’s data.
Read the articleCross-Site Scripting (XSS) explained simply
The flaw that turns a text field into a weapon: a visitor drops code into it, and that code runs for every other visitor. Explanation and defence.
Read the articleSQL injection explained simply
The flaw that lets a visitor rewrite the questions your site asks its database. How it works, and how to close it for good.
Read the articleFalse positives: the silent plague of scanners
A scanner that “finds” 400 flaws, 380 of them false, doesn’t help you: it exhausts you. The real challenge isn’t detecting more, it’s being wrong less.
Read the articlePath traversal: reading forbidden files
When a file name comes from the visitor, a few ../ can be enough to climb through your folders and read your secrets. Explanation and defence.
Read the article