FeaturedBusiness Logic·3 min read
Google Cloud Storage Misconfiguration Exposed User Data
Research
Writing from the engagement floor.
Techniques, methodology notes and write ups of vulnerability classes we keep finding, published with client permission and identifying detail removed.
14 articles
Penetration Testing·2 min read
NASA VDP Recognition: The Value of Precision in Reconnaissance
At XECbuild, we prioritize precision over noise. Read how targeted reconnaissance led to the discovery of a critical Brand Impersonation vulnerability within NASA's infrastructure, earning an official Letter of Recognition.
Penetration Testing·4 min read
The Illusion of Frontend Security: Exposing Enterprise PII through Unauthenticated APIs
A technical case study by XECbuild highlighting the critical dangers of relying solely on frontend authentication, leading to a high-severity employee PII exposure via an unprotected backend API.
Penetration Testing·4 min read
Critical Infrastructure Compromise: Weaponizing Exposed Log Aggregators via Hardcoded Secrets
A technical case study by XECbuild detailing how hardcoded JavaScript secrets and public-facing infrastructure led to the critical exposure of a production Grafana Loki instance, leaking PII and active administrator session tokens.
Authentication·
The Illusion of Client-Side Trust: Bypassing Enterprise Authentication via Response Manipulation
A technical case study by XECbuild highlighting how improper client-side trust and HTTP response manipulation led to a complete authentication bypass within a major enterprise portal.
Privilege Escalation·3 min read
Vertical Privilege Escalation: Exploiting Broken Function Level Authorization in Hierarchical APIs
A technical case study by XECbuild detailing how a Broken Function Level Authorization (BFLA) flaw in a major fintech platform allowed lower-privileged sub-users to extract sensitive operational tokens from administrative accounts.
Penetration Testing·3 min read
E-Commerce Supply Chain Risks: Weaponizing Third-Party Asset Exposures (CWE-16)
A technical case study by XECbuild detailing how a misconfigured third-party asset embedded within an e-commerce platform's product specifications created a critical supply chain and malware distribution risk.
Penetration Testing·4 min read
Persistent HTML Injection: UI Redressing and Content Spoofing in Critical National Infrastructure
A technical case study by XECbuild detailing how a persistent HTML injection vulnerability within a government chatbot integration exposed critical infrastructure to UI redressing and credential harvesting.
Broken Access Control·3 min read
Critical PII Exposure: Exploiting Broken Object Level Authorization (BOLA) in Travel Infrastructure
A technical case study by XECbuild detailing how a missing server-side authorization check (BOLA/IDOR) on a major travel platform exposed massive amounts of sensitive Personally Identifiable Information (PII).