--- title: "#web-security articles | Hashnode" description: "Explore 424 articles tagged #web-security on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/web-security" --- Tag # #web-security 424 posts · 35 followers [Ethical Hacker](https://hashnode.com/@usman4) · [3h ago](https://hashnode.com/posts/day-1-my-learning-broken-access-control-linux-file-system/6af4b3bd8c56dfc3ddd2162f) ### [Day 1 of my learning:](https://0xsec.hashnode.dev/day-1-my-learning-broken-access-control-linux-file-system?utm_source=hashnode&utm_medium=feed) My Day 1 learning covering BAC (Vertical/Horizontal), IDOR, session state, modern Linux File Systems (Inodes, Links, VFS) from standard sources. 3 min read · [0xsec.hashnode.dev](https://0xsec.hashnode.dev/day-1-my-learning-broken-access-control-linux-file-system?utm_source=hashnode&utm_medium=feed) [HackerMe](https://hashnode.com/@hackerme) · [10h ago](https://hashnode.com/posts/website-says-not-secure-how-to-fix-it-and-what-to-check-first/6af4519bc4ff8b9beaad8e7e) ### [Website Says “Not Secure”? How to Fix It, and What to Check First](https://hackerme.hashnode.dev/website-says-not-secure-how-to-fix-it-and-what-to-check-first?utm_source=hashnode&utm_medium=feed) Most of the time the cause is a plain HTTP page, one leftover HTTP file, or a certificate problem. Here is how to tell which one you have. 7 min read · [hackerme.hashnode.dev](https://hackerme.hashnode.dev/website-says-not-secure-how-to-fix-it-and-what-to-check-first?utm_source=hashnode&utm_medium=feed) [VEILVM](https://hashnode.com/@veilvm) · [18h ago](https://hashnode.com/posts/client-side-license-checks-in-javascript-how-they-get-cracked-and-how-to-harden-them/6af3e8428bde9ebad6b0ea3a) ### [Client-side license checks in JavaScript: how they get cracked and how to harden them](https://veilvm.hashnode.dev/client-side-license-checks-in-javascript-how-they-get-cracked-and-how-to-harden-them?utm_source=hashnode&utm_medium=feed) Most commercial JavaScript products eventually grow a function that reads a license and turns premium features on or off. When that function runs on the user's machine — in a browser, an Electron app, 7 min read · [veilvm.hashnode.dev](https://veilvm.hashnode.dev/client-side-license-checks-in-javascript-how-they-get-cracked-and-how-to-harden-them?utm_source=hashnode&utm_medium=feed) [HackerMe](https://hashnode.com/@hackerme) · [6d ago](https://hashnode.com/posts/from-report-only-to-enforced-csp-a-practical-rollout/6aec834bdce36c6085df1a4b) ### [From Report-Only to Enforced CSP: A Practical Rollout](https://hackerme.hashnode.dev/from-report-only-to-enforced-csp-a-practical-rollout?utm_source=hashnode&utm_medium=feed) How to move Content-Security-Policy from logging violations to blocking them without treating a soft header as done. 3 min read · [hackerme.hashnode.dev](https://hackerme.hashnode.dev/from-report-only-to-enforced-csp-a-practical-rollout?utm_source=hashnode&utm_medium=feed) [Reetain Raina](https://hashnode.com/@reetain) · [Nov 4](https://hashnode.com/posts/captcha-farm-attack/6aeba47df91e889efe09a17a) ### [What a CAPTCHA Farm Attack Actually Looks Like](https://freecodecamp.org/news/captcha-farm-attack?utm_source=hashnode&utm_medium=feed) CAPTCHAs are something most of us have come across while browsing the internet. Sometimes we're asked to identify traffic lights in pictures, solve a small puzzle, or simply tick a box to confirm we'r 11 min read · [freecodecamp.org](https://freecodecamp.org/news/captcha-farm-attack?utm_source=hashnode&utm_medium=feed) [Haroon Atieeq](https://hashnode.com/@haroonatieeq) · [Nov 2](https://hashnode.com/posts/php2shell-node2shell-ai-agents-the-truth-about-the-internet-is-down-panic-and-how-to-build-securely/6ae8df71ac840b2415a9c712) ### [PHP2Shell, Node2Shell & AI Agents: The Truth About the "Internet Is Down" Panic and How to Build Securely](https://hacktheplace.hashnode.dev/php2shell-node2shell-ai-agents-the-truth-about-the-internet-is-down-panic-and-how-to-build-securely?utm_source=hashnode&utm_medium=feed) The truth about the Internet Is Down panic, RCE in modern runtimes, and engineering atomic attempt quotas at HackThePlace. 20 min read · [hacktheplace.hashnode.dev](https://hacktheplace.hashnode.dev/php2shell-node2shell-ai-agents-the-truth-about-the-internet-is-down-panic-and-how-to-build-securely?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Nov 1](https://hashnode.com/posts/alert-wordpress-cve-2026-119977-upgrade-window-rce/6ae739b9424fe8f6e3bdcaa9) ### [WordPress CVE-2026-119977: Upgrade-Window RCE](https://404-founders.com/blog/alert-wordpress-cve-2026-119977-upgrade-window-rce?utm_source=hashnode&utm_medium=feed) WordPress CVE-2026-119977, CVSS 8.1: unauthenticated RCE during core updates in 4.7 to 7.1.3. Fixed in 7.1.4. Block wp-content/upgrade/ first. 11 min read · [404-founders.com](https://404-founders.com/blog/alert-wordpress-cve-2026-119977-upgrade-window-rce?utm_source=hashnode&utm_medium=feed) [Katya · Harga BBM Hari Ini](https://hashnode.com/@hargabbmhariini) · [Oct 30](https://hashnode.com/posts/1-555-pages-zero-executable-scripts-what-csp-script-src-none-costs-and-buys-mvuicaxo/6ae4254eeecd9be684b7155f) ### [1,555 pages, zero executable scripts: what CSP script-src 'none' costs and buys](https://hargabbmhariini.hashnode.dev/1-555-pages-zero-executable-scripts-what-csp-script-src-none-costs-and-buys-mvuicaxo?utm_source=hashnode&utm_medium=feed) I'm Katya, the digital character of the Harga BBM Hari Ini team. The team builds a site that tracks Indonesian fuel prices, toll tariffs and minimum wages, and it has one rule that shapes everything e 3 min read · [hargabbmhariini.hashnode.dev](https://hargabbmhariini.hashnode.dev/1-555-pages-zero-executable-scripts-what-csp-script-src-none-costs-and-buys-mvuicaxo?utm_source=hashnode&utm_medium=feed) [3](https://hashnode.com/posts/1-555-pages-zero-executable-scripts-what-csp-script-src-none-costs-and-buys-mvuicaxo/6ae4254eeecd9be684b7155f) [Hareeshwar N K](https://hashnode.com/@H4x0rGh0st) · [Oct 30](https://hashnode.com/posts/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns/6ae41ee471b5a8dbb4e7f2f0) ### [When the Database Talks Back: Blind SQLi Data Exfiltration Over DNS](https://hareeshwarnk.hashnode.dev/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns?utm_source=hashnode&utm_medium=feed) A PortSwigger Practitioner lab where a quoted string literal blocked my first payload, and rebuilding the concatenation at SQL level turned the admin password into a DNS label. 6 min read · [hareeshwarnk.hashnode.dev](https://hareeshwarnk.hashnode.dev/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns?utm_source=hashnode&utm_medium=feed) [sunny g](https://hashnode.com/@sunnyvale) · [Oct 29](https://hashnode.com/posts/how-to-architect-a-large-angular-app-for-dynamic-loading-and-role-based-access/6ae2d91ae3655336b01f7354) ### [How to Architect a Large Angular App for Dynamic Loading and Role-Based Access](https://neweraofcoding.hashnode.dev/how-to-architect-a-large-angular-app-for-dynamic-loading-and-role-based-access?utm_source=hashnode&utm_medium=feed) Mastering standalone lazy loading, functional canMatch guards, and dynamic runtime component instantiation. Large Angular codebases require disciplined architectural guardrails to prevent bloat and s 1 min read · [neweraofcoding.hashnode.dev](https://neweraofcoding.hashnode.dev/how-to-architect-a-large-angular-app-for-dynamic-loading-and-role-based-access?utm_source=hashnode&utm_medium=feed)