blog.doyensec.com resources

blog.doyensec.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-17.

AuthN 2 AuthZ 2 Fuzzing 2 SSRF 2 AI 1 API Sec 1 Burp 1 Deser 1 GraphQL 1 IDOR 1 Python 1 RCE 1

Date Added	Resource	Excerpt
2026-08-17 2026	The Danger of Multi-SSO AWS Cognito User Pools AuthN	Tool for analyzing AWS Cognito multi-SSO configurations, demonstrating vulnerabilities such as JIT ghost identity injection, trigger source value misinterpretations, and sub-splitting attacks. It highlights risks associated with malicious OIDC providers and insecure handling of IdP identifiers, leveraging Infrastructure as Code labs for experimentation.
2026-08-17 2026	When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax Fuzzing RCE	Library for weaponizing NASA's CFITSIO Extended Filename Syntax (EFS), allowing arbitrary file copies, forced downloads, and Server-Side Request Forgery (SSRF) by leveraging EFS features like the outfile clause and protocol handlers for HTTP, FTP, and other network protocols. The library also enables HTTP header injection by exploiting unescaped filename components in the HTTP driver. A Docker playground is available for reproducing these findings.
2026-08-17 2026	Navigating Lax Load Balancers: When an Intersection Gets You Inside AuthZ SSRF	Analysis of AWS Elastic Load Balancer (ELB) misconfigurations, focusing on Application Load Balancers (ALBs) and Network Load Balancers (NLBs). It details vulnerabilities like CloudFront/WAF bypass via direct ALB access, rule shadowing causing authentication bypass, and IP gate bypass via alternate ALBs. The analysis highlights that routing logic and actual traffic paths, not just static configuration, determine exposure, and provides actionable questions for auditors and developers to identify and prevent these issues.
2026-08-17 2026	Comparing AI Application Security Testing Platforms AI	Analysis of Aikido's Attack AI Pentest and XBOW's Lightspeed, two AI-driven application security testing platforms, evaluating their effectiveness in identifying vulnerabilities in modern web applications. The comparison involved manual validation of findings, classification of true and false positives, and assessment of the testing process, including configuration, impact, report quality, cost, and speed. This review offers insights into the maturity of AI penetration testing platforms and their potential future impact on application security testing.
2026-08-17 2026	Introducing Session Switcher. Swap Burp Sessions with One Click!AuthZ Burp IDOR	Library for managing Burp Suite HTTP sessions, Session Switcher streamlines authorization testing by allowing users to save and switch between multiple named sessions with a single click directly from the request editor. It automates the tedious process of copying and pasting cookies and headers, reducing errors and improving focus during privilege escalation and IDOR testing. The extension can also auto-update saved sessions by monitoring proxy traffic, ensuring authentication data remains valid throughout an engagement.
2026-04-16 2026	ksmbd: Fuzzing Improvements and Vulnerability Discovery Fuzzing	Library for improving fuzzing and discovering vulnerabilities in `ksmbd`, an SMB server implementation. This resource details techniques for expanding the attack surface by enabling configuration options like durable handles, oplocks, and SMB2 leases, and discusses fuzzer improvements. It specifically mentions patching NTLMv2 authentication, adjusting connection limits, and simulating valid SMB state transitions by parsing responses for TreeIDs and SessionIDs. The library also leverages protocol specifications to build grammars for commands like SMB2 IOCTL requests and explores fuzzing strategies such as focused area fuzzing to target specific code paths like `smb_check_perm_dacl`, which led to the discovery of integer overflows.
2026-04-10 2026	Doyensec: Common OAuth Vulnerabilities API Sec AuthN	Checklist for identifying common OAuth vulnerabilities, detailing attacks against the Implicit Flow, Authorization Code Flow, Authorization Code Flow with PKCE, Client Credentials Flow, Device Authorization Flow, and Resource Owner Password Credentials Flow. This resource helps testers and developers assess implementation security by explaining protocol complexities and known attack vectors.
2025-08-14 2025	GraphQL - Security Overview and Testing Tips · Doyensec's Blog GraphQL	Reference for GraphQL security testing, this article highlights common vulnerabilities like Broken Access Controls, Insecure Direct Object References, and SQL/NoSQL Injections. It recommends tools such as `graphql-ide` and a custom Python script (`GraphQL_Introspection.py`) for enumerating schemas. The text details testing tips for identifying exposed endpoints, such as `/graphql` or `/graphql.php?debug=1`, and emphasizes the need for developers to implement robust authorization logic, as GraphQL itself does not inherently secure data. It also discusses the risks of nested queries leading to DoS attacks and information disclosure through error messages.
2025-08-14 2025	SSRF Cross Protocol Redirect Bypass · Doyensec's Blog SSRF	Writeup detailing a Server-Side Request Forgery (SSRF) vulnerability, CVE-2023-28155, found in the `request` library. The bypass technique involves exploiting cross-protocol redirects, where a malicious server redirects an HTTPS request to an HTTP endpoint, circumventing SSRF filters that incorrectly reset the agent during protocol switches. The article also examines protections in `node-fetch` and `axios`, and includes a Semgrep rule to detect misconfigurations in Axios.
2023-06-06 2023	Reversing Pickles with r2pickledec Deser Python	Tool for decompiling Python pickle files, r2pickledec supports all instructions up to protocol 5. It integrates with Radare2, enabling analysis of pickle contents, including identifying serialized objects like "requests.sessions" and "Session," and understanding the assembly language used in pickles. The tool facilitates reversing complex pickle data by translating the byte stream into human-readable instructions and object structures.