Tag
I changed one thing in the address bar of a news website, and the site ran my JavaScript. This is a real reflected XSS, explained step by step: how input is reflected into an HTML attribute, how an autofocus/onfocus breakout fires code on page load, why a slash filter completely missed it, and the fix that actually works.
Forgot your password? So did I, and I used it to reset someone else's, silently, with no OTP and no notification sent to them. This is a real account-takeover bug in a university portal's reset flow, and the one architectural fix that closes it.
I sent one login request to a news website and got a ten-second delay back. That delay was enough to read an entire database, one bit at a time. Here is how time-based blind SQL injection really works, and the one fix that kills it.