HEBTECHCyber Securities Menu
Blog

Research notes & application-security writing

Practical write-ups on access control, business-logic flaws, API and mobile security from the HEBTECH team.

  • SSRF BUG

    SSRF = you trick the server into making requests on your behalf. App fetches an attacker-chosen URL instead of the intended one, turning the trusted server into a proxy into internal networks — hitting localhost, private ranges, or cloud metadata (169.254.169.254) to steal IAM creds. Fix: allow

    Read more