- [JWT jku Header Injection]
- [OAuth 2.0 Misconfiguration - Open Redirector]
- [postMessage Exploit for XSS]
- [AI-Powered Penetration Testing Framework]
- [Nuclei Templates Labs - Testing Playground]
[JWT jku Header Injection]
WhatAttackers can forge JWTs by specifying a malicious `jku` (JSON Web Key Set URL) in the header, pointing to attacker-controlled keys for signature validation. Example: `{"alg": "RS256", "typ": "JWT", "jku": "https://attacker.com/jwks.json"}`.
Sourcehivesecurity.gitlab.io
Applies toGeneral (applications using JWT for authentication)
Why it mattersThis is a straightforward method for authentication bypass if the app fails to validate the `jku` domain.
[OAuth 2.0 Misconfiguration - Open Redirector]
WhatOAuth authorization flows can be exploited using manipulated `redirect_uri` parameters to leak authorization codes to an attacker's domain. Example: `client_id=victim_app&redirect_uri=https://attacker.com/callback`.
Sourcehivesecurity.gitlab.io
Applies toGeneral (applications implementing OAuth 2.0)
Why it mattersThis remains a prevalent high-impact vulnerability leading to account takeover.
[postMessage Exploit for XSS]
WhatJavaScript's `postMessage` API can be abused for cross-site scripting (XSS) by opening a target window and sending a malicious payload after a short delay.
Sourcehivesecurity.gitlab.io
Applies toGeneral (applications using iframes or cross-window communication)
Why it mattersDemonstrates a modern client-side attack vector that can bypass some CSRF protections.
[AI-Powered Penetration Testing Framework]
WhatBlacksmithAI is an open-source framework that uses multiple AI agents to execute different stages of a security assessment lifecycle.
Sourcewww.helpnetsecurity.com
Applies toGeneral (red team tooling)
Why it mattersRepresents an evolving, automated attack methodology that defenders must understand.
[Nuclei Templates Labs - Testing Playground]
WhatProjectDiscovery released "Nuclei Templates Labs," a collection of vulnerable environments with ready-to-use Nuclei templates for hands-on security testing.
Sourceprojectdiscovery.io
Applies toGeneral (security team training and tool validation)
Why it mattersProvides a safe, controlled environment to practice detecting and exploiting common vulnerabilities at scale.
Is your WordPress site exposed to threats like these?
Arc is an AI security agent that watches your site 24/7 and patches vulnerabilities before attackers find them.
Scan your site free →