all auth bypass
Everything I've published,
in one feed.
2 posts across writeups, research, and technical deep-dives. Filter by tag.
2026.02.07
Enketo 6.2.1 - Auth-Bypass, SSRF, and XXE Browser Abuse to File Read
This article is the result of an OffenSkill Training. It discusses an unauthenticated arbitrary file read vulnerability found in the Enketo software, a web survey manager. The vulnerability, found during a white-box code review session, allows an unauthenticated attacker to read any arbitrary file on the server's by chaining an auth bypass, SSRF, XXE in svg and browser abuses.
10 min
2025.09.21
Amazon AppSec CTF: HalCrypto
CTF writeup: a JWT jku URL check uses lastIndexOf instead of real parsing, so an @ symbol tricks it into trusting an attacker-hosted JWKS and bypasses auth.
6 min