Archives
All the articles I've archived.
2026 4
July 1
-
Redirect URI Manipulation: Stealing the Authorization Code at the Door
The redirect_uri is the load-bearing control in the OAuth authorization code flow, and it fails quietly. A red-team walkthrough of manipulating it, reproduced against a real vulnerable client in the interception lab.
May 3
-
The Local Lab Blueprint: Building an Isolated, Scriptable Interception Lab
A reproducible, containerized interception lab for auth-flow research — mitmproxy, Docker, and browser session containerization, built to be torn down and rebuilt in under five minutes.
-
OAuth Authorization Code Interception: The Flow, the Seam, and What Your Logs Actually Show
Authorization code interception end-to-end: what the attack looks like, where the seam is, and what it produces in logs. Reproducible against FlawedToken.
-
The Gap Nobody Talks About: From "OAuth Is Attackable" to "Here's the Proof"
A controlled lab environment for auth-flow attack chains has never existed in any usable form. This series is about closing that gap.