https://niccoloparlanti.com/research/Offensive security research and field notes.LIKE-wildcard injection: a public leaderboard masked account numbers in its output but let search filters test the hidden digits.https://niccoloparlanti.com/bug-code/a-mask-shall-not-answer-questions/https://niccoloparlanti.com/bug-code/a-mask-shall-not-answer-questions/Mon, 07 Sep 2026 00:00:00 GMTUnauthenticated XXE in SAML: local DTD reuse turned a signed error response into a server-file disclosure channel.https://niccoloparlanti.com/bug-code/a-signed-response-is-not-a-safe-response/https://niccoloparlanti.com/bug-code/a-signed-response-is-not-a-safe-response/Mon, 07 Sep 2026 00:00:00 GMTServer-side template injection: brace-free QWeb syntax passed the WAF, then exposed privileged database reads and writes.https://niccoloparlanti.com/bug-code/a-template-is-not-an-administrator/https://niccoloparlanti.com/bug-code/a-template-is-not-an-administrator/Mon, 07 Sep 2026 00:00:00 GMTPath-only SSRF: a product ID redirected a backend request to an internal staff directory, then a decoding error exposed the response.https://niccoloparlanti.com/bug-code/an-id-shall-not-rewrite-the-route/https://niccoloparlanti.com/bug-code/an-id-shall-not-rewrite-the-route/Mon, 07 Sep 2026 00:00:00 GMTRecoverable password storage: a remember-me cookie retained a Base64-encoded password for 180 days, readable by page scripts.https://niccoloparlanti.com/bug-code/remember-the-device-not-the-password/https://niccoloparlanti.com/bug-code/remember-the-device-not-the-password/Mon, 07 Sep 2026 00:00:00 GMTPricing logic abuse: a guest-writable shopper context activated a scheduled future discount in the product response and basket.https://niccoloparlanti.com/bug-code/the-shopper-shall-not-set-the-clock/https://niccoloparlanti.com/bug-code/the-shopper-shall-not-set-the-clock/Mon, 07 Sep 2026 00:00:00 GMTA missing Content-Type header, Go’s MIME detection, and the browser behavior behind CVE-2026-43644.https://niccoloparlanti.com/research/podinfo-content-type/https://niccoloparlanti.com/research/podinfo-content-type/Sun, 06 Sep 2026 00:00:00 GMTFollowing a constructor name into dynamic code generation in TeleJSON.https://niccoloparlanti.com/research/telejson-constructor/https://niccoloparlanti.com/research/telejson-constructor/Sun, 06 Sep 2026 00:00:00 GMTAccount impersonation through email normalization: distinct authenticated subjects resolved to the same application account.https://niccoloparlanti.com/bug-code/a-token-is-not-an-account/https://niccoloparlanti.com/bug-code/a-token-is-not-an-account/Sun, 06 Sep 2026 00:00:00 GMTPrivilege escalation through invitation hijacking: a missing recipient check assigned an administrator role to a different account.https://niccoloparlanti.com/bug-code/invitation-is-not-identity/https://niccoloparlanti.com/bug-code/invitation-is-not-identity/Sun, 06 Sep 2026 00:00:00 GMTMissing API authentication: cloud-identity-backed processing and a signed diagnostic link exposed internal error data.https://niccoloparlanti.com/bug-code/service-identity-is-not-permission/https://niccoloparlanti.com/bug-code/service-identity-is-not-permission/Sun, 06 Sep 2026 00:00:00 GMTPreparation, practice, and lessons from my first penetration testing certification.https://niccoloparlanti.com/research/ejpt/https://niccoloparlanti.com/research/ejpt/Wed, 03 Jul 2024 00:00:00 GMTAn in-depth analysis of white-box adversarial attacks against deepfake-image detectors, exploring the vulnerability of AI-driven systems.https://niccoloparlanti.com/research/projects-evading-classifier/https://niccoloparlanti.com/research/projects-evading-classifier/Sun, 28 Jan 2024 00:00:00 GMTDesing and implement a Cryptographically Enforced Access Control using CP-ABEhttps://niccoloparlanti.com/research/projects-cryptographically-enforced-access-control/https://niccoloparlanti.com/research/projects-cryptographically-enforced-access-control/Wed, 08 Nov 2023 00:00:00 GMTWorking through cryptographic puzzles, from assumptions to solutions.https://niccoloparlanti.com/research/ths-crypto/https://niccoloparlanti.com/research/ths-crypto/Tue, 12 Sep 2023 00:00:00 GMTWriteups of the challenges of THS - Mischttps://niccoloparlanti.com/research/writeups-ths-challenge/https://niccoloparlanti.com/research/writeups-ths-challenge/Sun, 10 Sep 2023 00:00:00 GMTAn extensive report on security testing practices for identifying, assessing, and exploiting vulnerabilities in web applications, detailed with real-world data and code examples.https://niccoloparlanti.com/research/projects-vulnerability-assessment/https://niccoloparlanti.com/research/projects-vulnerability-assessment/Thu, 15 Jun 2023 00:00:00 GMTAn earlier set of hands-on web security challenges and their solutions.https://niccoloparlanti.com/research/dante-web/https://niccoloparlanti.com/research/dante-web/Mon, 05 Jun 2023 00:00:00 GMTWriteups of the Dante CTF 2023 - Forensicshttps://niccoloparlanti.com/research/writeups-dante-ctf-2023/https://niccoloparlanti.com/research/writeups-dante-ctf-2023/Mon, 05 Jun 2023 00:00:00 GMTEmbedding of a watermak using DWT-SVD and a DWT-DCT tranform.https://niccoloparlanti.com/research/projects-watermarking/https://niccoloparlanti.com/research/projects-watermarking/Tue, 18 Oct 2022 00:00:00 GMTA site that shows ticket offices, bus stops and tramway stops in the Florence area, using geolocation and routing programs to guide the user to the chosen destination.https://niccoloparlanti.com/research/projects-fastticket-webapp/https://niccoloparlanti.com/research/projects-fastticket-webapp/Fri, 08 Apr 2022 00:00:00 GMTTodoApp is a user-friendly and feature-rich task management application that helps users stay organized, increase productivity, and effortlessly manage their tasks and to-do lists.https://niccoloparlanti.com/research/projects-todolist/https://niccoloparlanti.com/research/projects-todolist/Sun, 24 Oct 2021 00:00:00 GMTTheoretical report on connected components and kruskal algorithm, with tests and related analysis.https://niccoloparlanti.com/research/projects-kruskal/https://niccoloparlanti.com/research/projects-kruskal/Wed, 08 Sep 2021 00:00:00 GMTThis project implements the Edit Distance algorithm with and without N-Gram support, providing a versatile tool for string similarity and comparison tasks in various domains.https://niccoloparlanti.com/research/projects-editdistance/https://niccoloparlanti.com/research/projects-editdistance/Sun, 05 Sep 2021 00:00:00 GMT