Skip to content
Tag

#appsec

1 post tagged “appsec”.

Five Characters Too Long: Auditing My Own URL Shortener
General· 8 min read

Five Characters Too Long: Auditing My Own URL Shortener

A hardcoded bcrypt hash was 65 characters instead of 60. That one detail turned my admin login into an account-enumeration oracle with a 6,000x timing signal and it was the first of ten findings.

All posts

Have something you want built properly?

Tell me what you're working on and I'll come back with a clear scope, a timeline and a fixed quote.

Start a conversation Email me directly