Web Cache Deception via Delimiter Discrepancies
Second web cache deception writeup: brute-forcing path delimiters with Burp Intruder to find one the origin honours but the cache ignores, then caching another user's API key.
Notes on web security.
I am Mai Tan Loi, a web developer moving into application security. I write up the labs I solve, the code I review, and the bugs I understand well enough to explain. Currently working toward OSWE.