https://kevinsec.io/tags/web-security/Recent content in Web-Security on KevinSecHugoen-usFri, 10 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/how-to-think-like-hackers/Fri, 10 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/how-to-think-like-hackers/A practical guide to developing hacker mindset: reverse thinking, logic abuse, zero trust, system decomposition, and attack chaining.https://kevinsec.io/blog/cors-misconfiguration-simple-mistake-serious-impact/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/cors-misconfiguration-simple-mistake-serious-impact/A practical explanation of CORS misconfiguration, why it matters, how to recognize risky patterns, and how to fix it safely.https://kevinsec.io/blog/file-upload-security-what-can-go-wrong/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/file-upload-security-what-can-go-wrong/A practical overview of file upload vulnerabilities, common failure patterns, testing ideas, and secure design recommendations.https://kevinsec.io/blog/how-to-write-a-professional-vulnerability-report/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/how-to-write-a-professional-vulnerability-report/A practical guide to writing clear, reproducible, and business-focused vulnerability reports for web application security testing.https://kevinsec.io/blog/jwt-security-testing-checklist/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/jwt-security-testing-checklist/A practical checklist for testing JSON Web Token security in web applications and APIs.https://kevinsec.io/blog/my-15-day-content-sprint-for-kevinsec/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/my-15-day-content-sprint-for-kevinsec/A transparent look at the 15-day content sprint used to build the first 30 KevinSec blog posts around web security, phishing awareness, and pentest methodology.https://kevinsec.io/blog/password-reset-vulnerabilities-common-patterns/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/password-reset-vulnerabilities-common-patterns/A practical guide to common password reset vulnerabilities, how they appear in real applications, and how to test them safely.https://kevinsec.io/blog/path-traversal-and-lfi-reading-files-you-should-not-read/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/path-traversal-and-lfi-reading-files-you-should-not-read/A practical introduction to path traversal and local file inclusion from a web pentesting perspective, with safe testing guidance and remediation patterns.https://kevinsec.io/blog/rate-limiting-the-control-that-many-apps-forget/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/rate-limiting-the-control-that-many-apps-forget/A practical guide to rate limiting as a security control for login, OTP, password reset, API, and resource-intensive endpoints.https://kevinsec.io/blog/reflected-xss-explained-context-root-cause-impact/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/reflected-xss-explained-context-root-cause-impact/A beginner-friendly explanation of reflected cross-site scripting from context to root cause, impact, testing, and remediation.https://kevinsec.io/blog/sql-injection-lab-from-error-message-to-root-cause/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/sql-injection-lab-from-error-message-to-root-cause/A safe lab-style walkthrough showing how to reason from a SQL error message to the root cause of SQL injection.https://kevinsec.io/blog/sql-injection-what-actually-happens-behind-the-query/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/sql-injection-what-actually-happens-behind-the-query/A beginner-friendly explanation of SQL injection from the perspective of query construction, untrusted data, and database interaction.https://kevinsec.io/blog/ssrf-explained-for-developers-and-pentesters/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/ssrf-explained-for-developers-and-pentesters/A practical explanation of Server-Side Request Forgery, why it happens, how to test it safely, and how developers can prevent it.https://kevinsec.io/blog/stored-xss-vs-reflected-xss-practical-differences/Wed, 08 Jul 2026 00:00:00 +0000https://kevinsec.io/blog/stored-xss-vs-reflected-xss-practical-differences/A practical comparison of stored XSS and reflected XSS, including root cause, exploitability, impact, detection, and remediation.https://kevinsec.io/blog/authentication-testing-checklist-for-web-applications/Wed, 08 Jul 2026 00:00:00 +0700https://kevinsec.io/blog/authentication-testing-checklist-for-web-applications/A practical authentication testing checklist for web applications.https://kevinsec.io/blog/broken-access-control-why-it-is-still-critical/Wed, 08 Jul 2026 00:00:00 +0700https://kevinsec.io/blog/broken-access-control-why-it-is-still-critical/Understand why broken access control remains one of the most critical web application security risks.https://kevinsec.io/blog/how-to-read-an-http-request-like-a-pentester/Wed, 08 Jul 2026 00:00:00 +0700https://kevinsec.io/blog/how-to-read-an-http-request-like-a-pentester/A beginner-friendly guide to reading HTTP requests from a web pentesting perspective.https://kevinsec.io/blog/owasp-top-10-2025-explained-for-beginners/Wed, 08 Jul 2026 00:00:00 +0700https://kevinsec.io/blog/owasp-top-10-2025-explained-for-beginners/A beginner-friendly explanation of the OWASP Top 10 2025 web application security risks.https://kevinsec.io/blog/untrusted-data-root-of-most-web-vulnerabilities/Wed, 08 Jul 2026 00:00:00 +0700https://kevinsec.io/blog/untrusted-data-root-of-most-web-vulnerabilities/Understand why untrusted data is one of the most important concepts in web application security.https://kevinsec.io/research/sample-research-note/Sun, 05 Jul 2026 15:07:00 +0700https://kevinsec.io/research/sample-research-note/A sample research note template for vulnerability analysis on KevinSec.