Security research, field notes, and practical experiments
Independent technical notes by Willis Vandevanter, published in reverse chronological order.
The 2026-07-28 Model Context Protocol specification is out. One interesting addition for application security: List results are cacheable Responses from tools/list, prompts/list, resources/list, and resources/read now carry ttlMs and cacheScope (SEP-2549). …
Misconfigured GraphQL implementations can allow for attackers to bypass authorization and access internal APIs. These “secondary context attacks” exploit the gap between GraphQL’s frontend interface and backend REST services, often turning simple path …
The @trickest Inventory project is an interesting resource. It has a massive set of hostnames, live services, spidered URLs, and cloud data organized by Bug Bounty program. There is so much more data than I have interest in storing for my needs. In fact, the …
Edit: 1.1b fixes an auto shutdown issue in burpsuite, I would highly recommend this release over 1.1a. The rest of the post still applies. This is a small release but a useful one. Release 1.1b adds the ability to parse projects for portions of siteMap and …
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the …
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the …
SSRF protocol smuggling involves an attacker injecting one TCP protocol into a dissimilar TCP protocol. A classic example is using gopher (i.e. the first protocol) to smuggle SMTP (i.e. the second protocol): 1 …
I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is to be (1) simple, (2) fast, and (3) work on many platforms with only one dependency – nokogiri. …
Recently ColdFusion was shown vulnerable to XXE based attacks in OXML documents; CVE-2016-4264. The blog post linked gives an example building the file using python; cool! It’s easy to backdoor files in a similar fashion with OXML XXE. The fastest way to do …
Finding hosts or domain names associated with a company where the domain name does not include the name of the company can sometimes be difficult. There are common ways to do it such as ASN or scope information (e.g. bug bounty ToE or IP block). One technique …