Premium · CCLI
Not writeups you skim — playable reconstructions. Each methodology is a self-contained, in-browser lab where you send the real probe against a sandboxed target and watch it break. New methods land as they're discovered and reverse-engineered.
The library
One card per technique. Live ones open a full interactive lab; the rest are queued and land continuously.
The {{7×7}} → 49 tell. Fire probes at a real sandboxed template engine and watch reflection turn into evaluation.
Leak a secret you can't read: filter on a forbidden column and binary-search the token out, character by character.
Bounce a fetch through redirects to reach internal metadata endpoints past naive allow-lists.
Split one connection into two views. Watch a smuggled request steal the next visitor's response.
Two parsers, one input, two readings. The gap between them is the vulnerability.
Where WebAuthn's promises meet real-world implementation gaps.