Writing / Articles

Blogs and Write-ups

On full-stack development, security, and other engineering topics.

Blogs: 0
Write-ups: 0

Filter Posts

Refine the collection by the options below.

Type

Topic

Date

Showing 14 of 14 items

Sort

Stored XSS: How Unsanitized Input Leads to Script Execution cover image

Jer Catallo

Write-up

Aug 2, 2026

Stored XSS: How Unsanitized Input Leads to Script Execution

#stored XSS#output encoding#Content Security Policy

Stored cross-site scripting occurs when an application saves untrusted input and later renders it as executable HTML for other users. The article explains a blind stored XSS flow through support tickets, including safe testing and defenses such as output encoding, input validation, Content Security Policy, and HttpOnly cookies.

7 min readRead

Local File Inclusion: How Can You Check and Prevent LFI Before It Becomes RCE? cover image

Jer Catallo

Write-up

Jul 5, 2026

Local File Inclusion: How Can You Check and Prevent LFI Before It Becomes RCE?

#LFI#path traversal#secure file inclusion

Local file inclusion happens when a web application uses user-controlled paths without strict validation, allowing attackers to read unintended local files. This practical guide tests traversal, sensitive-file exposure, and upload-to-execution chaining in a controlled lab, then covers allowlists, secure uploads, secret management, and least privilege.

4 min readRead

Remote File Inclusion: How a Single URL Parameter Can Give Attackers Full Control of Your Server cover image

Jer Catallo

Write-up

Jun 20, 2026

Remote File Inclusion: How a Single URL Parameter Can Give Attackers Full Control of Your Server

#RFI#remote code execution#URL validation

Remote File Inclusion (RFI) is a web vulnerability where an application accepts a URL from user input, fetches the file at that URL, and executes it. Demonstrates how attackers host malicious scripts and pass their URLs to vulnerable endpoints, achieving remote code execution without authentication.

7 min readRead

Path Traversal: What It Is, Why It's Dangerous, and How to Stop Attackers from Reading Files They Shouldn't cover image

Jer Catallo

Write-up

Jun 14, 2026

Path Traversal: What It Is, Why It's Dangerous, and How to Stop Attackers from Reading Files They Shouldn't

#path traversal#directory traversal#file system security

Path traversal is a web vulnerability where an attacker reads files outside the directory your application intends to serve. Shows how attackers chain ../ sequences to access environment files, database backups, and cloud credentials. Includes vulnerable code examples in PHP, Python, Node.js, and Java with remediation patterns.

10 min readRead

IDOR: What Is It and How Does One URL Change Expose Every User's Data? cover image

Jer Catallo

Write-up

Jun 7, 2026

IDOR: What Is It and How Does One URL Change Expose Every User's Data?

#IDOR#access control#authorization testing

IDOR, or Insecure Direct Object Reference, is one of the most common and easy-to-miss access control flaws in web applications. Demonstrates how changing a single number in a URL can expose other users' data when the server skips ownership checks. Covers identification, testing, and remediation with server-side validation examples.

5 min readRead

Cookie Tampering: How Attackers Modify Cookies to Break Into Web Apps (And How You Can Prevent It) cover image

Jer Catallo

Write-up

May 30, 2026

Cookie Tampering: How Attackers Modify Cookies to Break Into Web Apps (And How You Can Prevent It)

#cookie manipulation#session security#authentication bypass

Web apps trust cookies to track identity and permissions, but unprotected cookies are an open door. Covers three common tampering techniques (plain-text manipulation, hashed bypass, and base64 decoding) and how to properly secure them.

6 min readRead

Disclaimer

All trademarks and logos belong to their respective owners and are used here solely for identification purposes in a non-commercial, personal portfolio. No endorsement or affiliation is implied. If you have any concerns, feel free to reach out and I'll be happy to address them.