Rrathsarainrr-cyber.hashnode.dev·11h ago · 8 min readI Built What I Thought Was a Secure App. Here's Everything I Got Wrong.During the final year of my undergraduate studies, my team submitted a cloud-based banking application as part of our Network and Cloud Security coursework. We had competition. Two other teams were bu00
DTDuy Tien Nguyeninduytien.dev·1d ago · 7 min readOne assumption, four different trust mechanismsSigning infrastructure is invisible until it fails. And when it fails, the question that comes up is rarely "what broke technically" - it's "who actually did this." JWT, mTLS, HSM-backed signing, bloc00
RMRenukashree Muraliinquietbytes.hashnode.dev·1d ago · 5 min readJWT Attack Lab — Part 8: Algorithm Confusion, and a Bug the Attack Uncovered By AccidentPart 8, the final stage in a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 7 closed a gap in expiry enforcement. This last stag00
RMRenukashree Muraliinquietbytes.hashnode.dev·1d ago · 4 min readJWT Attack Lab — Part 6: Spoofing the JWKS URL an RSA Verifier TrustsPart 6 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 5 exploited kid to point a local file lookup somewhere unintended. Th00
RMRenukashree Muraliinquietbytes.hashnode.dev·1d ago · 4 min readJWT Attack Lab — Part 4: Cracking a Weak HMAC Secret With HashcatPart 4 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 3 fixed the alg: none bypass by explicitly restricting which algorith00
CSCraig Solomonincraigsolomon.hashnode.dev·1d ago · 7 min readDual-Chain Blockchain Anchoring via REST API in PythonYou've got a file. You need an immutable timestamp on Polygon and Bitcoin. The file stays on your machine. Only the SHA-256 hash leaves. Three API calls to the ProofLedger v1 API and a polling loop ge00
HKHemanth KRinzk-dev-notes.hashnode.dev·2d ago · 4 min readWhy do most modern zero knowledge proof systems convert the computations to polynomial equations ?Let's get started : Assume we have a problem with five computations, now to verify these computations, the verifier will have to execute all those 5 computations and compare the computed value with th00
AZAnatolii Zhadaninanatoliizhadan.hashnode.dev·5d ago · 34 min readHow to Deploy a Self-Hosted 2-of-3 MPC Signing Cluster (Without Losing Everyone's Keys)Three independent MPC nodes, each holding one key share. The backend never holds a key. It sends a 32-byte digest and gets a signature back. A restored MPC cluster can boot up, report [READY] on all t00
RMRenukashree Muraliinquietbytes.hashnode.dev·6d ago · 6 min readBuilding a PKI From Scratch, Part 1: The Root CAWhat this does I'm building a complete Public Key Infrastructure by hand — a Root Certificate Authority, an Intermediate CA, end-entity certificate issuance, revocation, and CRL generation — using Pyt00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 12 · 7 min readBroncoCTF : Atomic Substitution Theory WriteupChallenge We're given secret.txt, a single line of comma-separated tuples wrapped in what looks like braces and underscores: (4, 17), (2, 16), (2, 15), (4, 9), { , (3, 2, 1), (5, 3), _ , (2, 17), ... 11A
