Research

Dub enforces workspace link limits against an asynchronously reconciled counter, so concurrent POST /api/links requests all observe the same stale value and all pass validation. A free-tier workspace ended up at 220% of its monthly quota. Vendor closed as an intentional latency tradeoff, so the primitive still works.

The image field on dub's partner onboarding action passes through a permissive Zod branch straight into a server-side fetch(). The response body is stored at a public dubassets.com CDN URL. A DNS rebinding bypass defeats the private-IP block on self-hosted deployments, with a full end-to-end reproduction.

Field guide to client-side path traversal and CSPT2CSRF, with diagrams and a full walkthrough of Polecat, the Firefox extension we built at Zypher and use on engagements. Explains how the bug class works, why manual DevTools hunting misses it, and the browser-side workflow that catches it.

A custom offensive tool we built at Zypher that combines the Microsoft OAuth device code grant with email image defacing. One spoofed email carries a server-rendered PNG that repaints with a fresh device code on every open, defeating the 15-minute expiry that has always broken the technique at scale. Field-tested at GetConnects and other client engagements.

How a self-XSS on an Alibaba AI chatbot and a location-sink postMessage handler chained into seven critical one-click account takeovers across the *.alibaba.com cookie scope, filed in six days.

Three URL parameters on /substudy/ezform.php reach HTML attribute and inline JavaScript contexts with no encoding, letting a crafted link execute JavaScript in the victim's session.

Two GET parameters on /substudy/ezform.php are concatenated straight into MySQL queries, giving an unauthenticated attacker full read of the underlying database, including patient records.