TLS Handshake Notes for Defenders
Lab openssl s_client -msg against a loopback nginx: handshake record dump, redacted CN, alert on a bad name — not a MITM cookbook.
Network Security
Financial Apps: Concurrency Bugs vs Authorization Flaws
Lab SQLite ledger: UPDATE without a version column vs WITH version, plus an IDOR that is not a race — no money-drain client.
Tabnabbing, target=_blank, and Related XSS Edges
Lab HTML: target=_blank without rel, opener check in the opened tab, rel=noopener fix, harmless location rewrite — no phishing kit.
YAML Parser Footguns Across Languages
Lab PyYAML: yaml.safe_load vs yaml.load, implicit typing, billion-laughs-sized crash — no os.system gadget via YAML tags.
Web Race Conditions: Coupons, Balances, and Workflows
Lab Go counter without a mutex, then with one; HTTP coupon handler; lost-update logs — no inventory-drain exploit script.
Apache HTTP Path Confusion Notes (CVE-2021-41773 Class)
Lab Apache Alias map: raw vs normalized paths as text, Require/Alias mismatch, 403/404 artifacts — no working traversal into /etc.
Lessons from the JNDI / Log4Shell Class of Bugs
Lab Java snippet that logs a lookup string, how to disable JNDI/message lookups, sanitized crash on a bad URL — no LDAP exploit server.
DOM XSS and DOM Clobbering as Trust Problems
Lab HTML+JS page: location.hash into innerHTML, name=form clobber of a config object, harmless redacted payload, CSP as the fix.