np↗Niccolò ParlantiOFFENSIVE SECURITY

RESEARCH / ADVISORIES / FIELD NOTES

Notes from
the attack surface.

Vulnerability writeups, public advisories, and the assumptions that failed under testing.

24 articles

01
The Bug CodeArticle 01

A template shall not promote its author.

Server-side template injection: brace-free QWeb syntax passed the WAF, then exposed privileged database reads and writes.

02
The Bug CodeArticle 02

An identifier shall not choose the route.

Path-only SSRF: a product ID redirected a backend request to an internal staff directory, then a decoding error exposed the response.

03
The Bug CodeArticle 03

A signature shall not vouch for what the parser swallowed.

Unauthenticated XXE in SAML: local DTD reuse turned a signed error response into a server-file disclosure channel.

04
The Bug CodeArticle 07

The shopper shall not set the clock.

Pricing logic abuse: a guest-writable shopper context activated a scheduled future discount in the product response and basket.

05
The Bug CodeArticle 08

A mask shall not answer questions about what it hides.

LIKE-wildcard injection: a public leaderboard masked account numbers in its output but let search filters test the hidden digits.

06
The Bug CodeArticle 09

Remember the device. Forget the password.

Recoverable password storage: a remember-me cookie retained a Base64-encoded password for 180 days, readable by page scripts.

07
The Bug CodeArticle 04

A valid token shall speak for one account only.

Account impersonation through email normalization: distinct authenticated subjects resolved to the same application account.

08
The Bug CodeArticle 05

A service shall not lend its privileges to strangers.

Missing API authentication: cloud-identity-backed processing and a signed diagnostic link exposed internal error data.

09
AdvisoryCVE-2026-43644

When an echo endpoint becomes a script runner

A missing Content-Type header, Go’s MIME detection, and the browser behavior behind CVE-2026-43644.

10
AdvisoryCVE-2026-47099

The moment JSON stops being data

Following a constructor name into dynamic code generation in TeleJSON.

11
Archive2024

My experience with eJPTv2

Preparation, practice, and lessons from my first penetration testing certification.

12
Archive2024

Evading Deepfake Classifier with Adversarial Attacks

An in-depth analysis of white-box adversarial attacks against deepfake-image detectors, exploring the vulnerability of AI-driven systems.

13
Archive2023

Cryptographically enforced access control

Desing and implement a Cryptographically Enforced Access Control using CP-ABE

14
Archive2023

THS challenges: cryptography

Working through cryptographic puzzles, from assumptions to solutions.

15
Archive2023

THS Challenges Writeups - Misc

Writeups of the challenges of THS - Misc

16
Archive2023

Vulnerabilities Identification and Exploitation

An extensive report on security testing practices for identifying, assessing, and exploiting vulnerabilities in web applications, detailed with real-world data and code examples.

17
Archive2023

Dante CTF: web challenges

An earlier set of hands-on web security challenges and their solutions.

18
Archive2023

Dante CTF Writeups - Forensics

Writeups of the Dante CTF 2023 - Forensics

19
Archive2022

Image watermarking with DWT, SVD, and DCT

Embedding of a watermak using DWT-SVD and a DWT-DCT tranform.

20
Archive2022

FastTicket Web App

A site that shows ticket offices, bus stops and tramway stops in the Florence area, using geolocation and routing programs to guide the user to the chosen destination.

21
Archive2021

Todo List

TodoApp is a user-friendly and feature-rich task management application that helps users stay organized, increase productivity, and effortlessly manage their tasks and to-do lists.

22
Archive2021

Kruskal Algorithm

Theoretical report on connected components and kruskal algorithm, with tests and related analysis.

23
Archive2021

Edit distance with and without N-grams

This project implements the Edit Distance algorithm with and without N-Gram support, providing a versatile tool for string similarity and comparison tasks in various domains.

24
The Bug CodeArticle 06

An invitation shall admit its recipient. Nobody else.

Privilege escalation through invitation hijacking: a missing recipient check assigned an administrator role to a different account.

EARLIER WORK

The archive.

Browse CTF writeups, projects, and learning notes, collected in one place.