The Curious Engineer

All blogs / Security

Sjoerd Langkemper

sjoerdlangkemper.nl

Web application security

SecurityPHPWeb development

’05’10’15’20’25
Posts
176 from 31 Jul 2003 to 28 Oct 2026
Posting
now and then (5 in the last year)
Kind
personal blog
Feed
http://www.sjoerdlangkemper.nl/feed.xml

2026 4

  1. Passwords are always short, but bcrypt's limit can still be problematic
  2. File and post data confusion in PHP
  3. Changing the timing of light with passive infrared sensor
  4. Vulnerabilities in zdir 3

2025 5

  1. Links for 2025
  2. Unicode and endianness
  3. CVE-2025-25200: this Koa ReDoS is not a serious vulnerability
  4. Resetting any user's password in Open Web Analytics with a single request
  5. Encrypting identifiers in practice

2024 16

  1. More links
  2. Avoid hotlinking images with Cross-Origin-Resource-Policy
  3. Amplification for compression attacks
  4. If you don't want to solve a captcha, simply don't request one
  5. Removing and encoding null bytes to exploit unserialize over SOAP
  6. Parsing untrusted JSON in Python is not a security problem
  7. Links
  8. Book review: The Seven Husbands of Evelyn Hugo
  9. HTMX does not play well with content security policy
  10. Seed of random number generator carried across connections in MariaDB
  11. String comparison timing attacks
  12. Twig retrieves each attribute twice on Eloquent models
  13. Create objects instead of strings
  14. Curl facilitates header injection
  15. Session poisoning Zen Cart for a free discount
  16. MySQL's random number generator

2023 17

  1. A practical attack on Hashids
  2. Securing HTML fragments returned by API endpoints
  3. I made a client-side spamfilter for Tutanota email
  4. Tweakable block ciphers
  5. Origin header in password reset email
  6. Block ciphers with a 64 bit block size
  7. Short session expiration does not help security
  8. encrypting identifiers
  9. previous post
  10. My experience with organizing a giving game
  11. MIME type sniffing and the X-Content-Type-Options: nosniff header
  12. IP spoofing and SQL injection in Textcube
  13. Cookie prefixes turn security problems into functional problems
  14. XSS in ViewVC
  15. Should 2FA secrets be encrypted?
  16. Mark sensitive information as such in the source code
  17. Clever ORM causes password reset vulnerability

2022 6

  1. Running Etherkey on an ATmega32u4 to emulate a keyboard
  2. Enforcing object lifecycles through interfaces
  3. Avoid passing secrets in build arguments in Docker
  4. MCH 2022 hacker camp - personal anecdotes
  5. MCH 2022 hacker camp - technical talks and workshops
  6. Lucky 13 and other padding oracle attacks on CBC ciphers

2021 5

  1. Git submodules update to default branch, except when it's changed
  2. How does git diff --ignore-matching-lines work
  3. Long passwords don't cause denial of service when using proper hash functions
  4. Remote code execution through unsafe unserialize in PHP
  5. Adding request headers to image requests using a service worker

2020 16

  1. IoT security regulation
  2. Comparison of IoT security frameworks
  3. The most important security problems with IoT devices
  4. Essential requirements for securing IoT consumer devices
  5. Infinite loop leads to denial of service in Centreon
  6. Overwriting HttpOnly cookies using cookie jar overflow
  7. Testing Android apps on a virtual machine
  8. Combine two word lists for cracking passwords
  9. Abusing javascript:history.back() as an open redirect
  10. The struggle of perfectionism
  11. Bypass virus scanners by renaming files
  12. How to open a Compal CH7465LG-ZG Ziggo Connect Box
  13. The case for client-side hashing: logging passwords by mistake
  14. Grepping functions with srcML
  15. Cracking password hashes in Yclas
  16. Matrix.org hack

2019 29

  1. Should each form have a different CSRF token?
  2. XSS in username in Sakai
  3. Breaking message franking
  4. Most commonly used Dutch passwords
  5. A cheap alternative for Mictor 38 debugging connectors
  6. Reflected XSS in Yclas
  7. Second order SQL injection in ZoneMinder
  8. My pen testing project setup
  9. Insecure direct object reference in Growatt
  10. How to survive an office job
  11. A method to do TLS on IoT devices
  12. Learning how to be a pentester
  13. Command injection on CommonAccord
  14. Attacking RSA keys
  15. Open redirect in CrushFTP
  16. Logging DNS requests with internet sharing on macOS
  17. ENISA Technical Measures for IoT
  18. Working with bits and bytes in Python 2 and 3
  19. Quickly set up a test mail server
  20. Hacking the Motorola MBP88Connect WiFi camera
  21. USB to UART serial bridges
  22. Coverage of a security assessment
  23. Prevent CSRF with the Origin request header
  24. A USB Wi-Fi adapter that works with MacOS Mojave
  25. Securing against cyber-attacks
  26. Impact of cyberattack
  27. probability
  28. CSRF protection
  29. Accessing cross-site data using JSONP

2018 23

  1. Practice your hacking skills with these CTFs
  2. Take over sessions in Metasfresh using CORS
  3. Should you update jQuery over a hypothetical vulnerability?
  4. Truncating strings with MySQL
  5. Creating custom word lists for password cracking
  6. Which CORS headers do you need to send an Authorization header?
  7. Changing your password through CSRF in IceHRM
  8. Automating path traversal with protravel
  9. Path traversal in Monstra CMS
  10. PHP type confusion on password comparison
  11. Discovering subdomains
  12. Vulnerability bingo
  13. Finding common files in the webroot
  14. Detecting postMessage interfaces
  15. bit flip
  16. Grepping functions with ANTLR
  17. Intercepting HTTP requests with mitmproxy
  18. Hacking the Huawei HG655d
  19. Experiences with the CC2530 Zigbee IC
  20. Ubuntu mirrors behind on security updates
  21. Upgrading a password hash function
  22. Problems with pwdhash
  23. Testssl.sh vs. OWASP O-saft

2017 24

  1. Password hashing considerations
  2. Breaking cryptography using quantum computers
  3. Comparing secure strings in .NET
  4. Leave secure cookies alone
  5. Open redirect with authentication in OpenText Documentum
  6. Libraries that evaluate remote JavaScript
  7. Attacks on the Host header
  8. Hacking from within the browser with Tamper Chrome
  9. From developer to pentester
  10. Burp intruder attack types
  11. Drive-by remote code execution in MAMP
  12. Prevent session hijacking with token binding
  13. Bypass CSRF checks using referrer policy
  14. searching for vulnerable projects
  15. Automating web application attacks with Tampermonkey
  16. Generating password lists with regular expressions
  17. Checking whether files exist outside open_basedir
  18. Downloading an exposed Mercurial .hg directory
  19. vBulletin random number function
  20. Don't use base_convert on random tokens
  21. Bypass IP blocks with the X-Forwarded-For header
  22. Securing cookies with cookie prefixes
  23. Checking passwords against a dictionary in ASP.NET MVC
  24. Book review: Bulletproof SSL and TLS

2016 30

  1. Check CRSF token by default in ASP.NET MVC
  2. Strengthening password hashes by brute-forcing random data
  3. Adding a HTTP header to Nikto requests
  4. HTTPS does not provide privacy
  5. The economics of certificate transparency
  6. Current state of breach attack
  7. The password guessing bug in Tenex
  8. SSRF in LiveAgent
  9. Attacking JWT authentication
  10. Uploading webshells using .NET MoxieManager
  11. XSS in Kayako helpdesk software
  12. compression side channel attacks
  13. Interesting recent web application hacks
  14. Intercepting smartphone HTTP requests on MacOS
  15. Fuzzing SAML with SAMLReQuest
  16. Headers to block iframe loading
  17. Insecure token generation in Kayako
  18. Overwriting memory in Python
  19. How PHP's uniqid works
  20. Requirements for iterative password hashing
  21. “Clearing secrets from memory”
  22. XSS in user-agent header in Bolt CMS
  23. Combining CSRF and timing attacks
  24. Preventing CSRF with the same-site cookie attribute
  25. Django's reset password mechanism
  26. Datatypes for pycrypto in Python 3
  27. Opentape authorization vulnerability
  28. Polymorphic Javascript malware
  29. Cracking PHP rand()
  30. Circumventing XSS filters

2003 1

  1. Ataxx