Insecure deserialization occurs when untrusted data is deserialized into objects, allowing attackers to abuse object lifecycle methods and existing code paths (gadgets) to trigger unintended behavior such as RCE.
Attackers inject object graphs, not code.
Modern web applications often require communication between multiple browsing contexts — windows, iframes, tabs, popups, or even workers.
The browser provides several APIs for this, each suited for different scenarios.
Purpose: Quick reference for headers that can override or indicate original request URL/path/host/proto. Useful for VAPT, debugging reverse proxies, and hardening.
X-Original-URL — original path before rewrite (IIS, some middlewares)X-Rewrite-URL — original path used by IIS/mod_rewrite
This document provides a high-level overview of major XML technologies. It's designed for developers who need a quick refresher on core concepts, common quirks, and practical examples.
The foundation. A markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable.
A reference of quirks, behaviors, and security-relevant properties in HTML5 + SVG, useful for penetration testing, payload crafting, and filter bypass research.
HTML Elements Parsing quirks - link mXSS CheatSheet
<animate> element in SVG is used to animate attributes of another SVG element.<animate> has no href, the parent element becomes the host.<animate href="#id"> is present, the host = the element with that ID.