All research on Crusader Research

Line jumping: how a poisoned MCP tool hijacks a model that was never called

Sun, 05 Jul 2026 00:00:00 +0000

Most MCP security write-ups tell you each server is “a new trust boundary.” True, and useless — because it makes you picture a door you choose to walk through. The real problem is that you don’t. The dangerous instruction runs the instant you connect the server, before you invoke anything. The attack fires at handshake time, not at call time.

Here is the protocol detail that makes MCP different from every integration you’ve audited before. When a client connects, it calls tools/list and the server returns each tool’s name, input schema, and a natural-language description. That description is not shown to the model when the tool is called — it’s loaded into the model’s context immediately, at tools/list time, so the model knows which tools exist and when to reach for them. The description is in the prompt from the first token of the conversation onward.

Parameter mining: brute-forcing 65,000 inputs in 40 requests

Sun, 05 Jul 2026 00:00:00 +0000

Every endpoint has two input surfaces: the parameters the client sends, and the parameters the server will bind if you happen to name them. The second surface never appears in your proxy history, never appears in the OpenAPI spec, and never gets a test written against it — which is exactly why the privilege flags and debug toggles live there. A framework binds request fields onto a model. The web and mobile clients populate six of them. The other four — is_admin, debug, internal_notes, account_id — are wired up, honored, and completely untested because nobody sends inputs they don’t know exist.

SSRF past the easy filters: URL-parser confusion and the metadata endpoint

Sun, 05 Jul 2026 00:00:00 +0000

Server-side request forgery is one of the few bug classes where a single finding hands you cloud credentials. The mechanic is trivial to state — you make a server fetch a URL you control — and every write-up stops there, which is exactly why they’re useless. The tutorial payload, http://169.254.169.254/ pasted into a URL field, has been blocklisted everywhere. The reason SSRF is still one of the most productive bug classes in 2026 isn’t that developers forgot to filter. It’s that their filter and their HTTP client read the URL differently, and you live in the gap.

Tearing the APK apart: the static pass that finds a critical before you set a proxy

Sun, 05 Jul 2026 00:00:00 +0000

Most mobile write-ups treat static analysis as the boring prelude — decompile, skim, “note any hardcoded secrets,” then get to the real work of intercepting traffic. That framing is why testers miss criticals that were sitting in a zip file the whole time. The dynamic pass only shows you what the app does while you drive it. The static pass shows you the endpoints behind feature flags, the components every other app on the device can reach, and the one Firebase URL that turns into a report before you’ve opened a proxy.

Winning web race conditions with the single-packet attack

Sun, 05 Jul 2026 00:00:00 +0000

Most write-ups tell you a race condition is a “timing window between check and use.” True, and useless — because the reason your race attacks fail isn’t that you don’t understand the concept. It’s that the window is smaller than the internet is precise.

A typical race window — the gap between an app reading balance and writing balance - amount — is measured in microseconds to a few milliseconds. The jitter between two HTTP requests you send at the same instant, by the time they arrive and get scheduled on the server, is routinely 1 to 10 milliseconds, and worse across the public internet. So your “simultaneous” requests arrive in a neat little line, the server processes them one at a time, the limit holds, and you conclude the endpoint is safe. It isn’t. You just lost the race to network jitter before the server ever got a vote.

IDOR lives in the second identifier: finding BOLA with two-account Shadow Replay

Sat, 04 Jul 2026 00:00:00 +0000

Every IDOR tutorial hands you the same drill: find /api/orders/48210, change it to 48211, look for a 200. That drill trains you to attack the one identifier the application is most likely to check. The primary key in the URL path is where the framework’s @authorize annotation lives, where the ORM scopes the query, where the review focused. It’s the honeypot. You fuzz it, get 403s, call the endpoint safe, and walk right past the bug.

Indirect prompt injection is SSRF for the agent era

Fri, 03 Jul 2026 00:00:00 +0000

Most write-ups tell you prompt injection is “when the model follows instructions in its input.” True, and useless — because that framing makes it sound like a chatbot quirk you patch with a better system prompt. It isn’t. It’s an architecture bug you already know by another name.

SSRF happened because a server would fetch a URL you controlled and trust the response. Indirect prompt injection happens because an agent reads content you control — a web page, a PDF, an email, a calendar invite — and trusts it as instructions. Same defect, new medium. The server-side fetch became a model-side read; the trusted response became a trusted command.

The Android 14 CA move that broke every '/system/etc' pinning tutorial

Thu, 02 Jul 2026 00:00:00 +0000

Ninety percent of mobile testing is web testing you already know — REST, tokens, IDOR, injection. The other ten percent is a wall you hit before you can do any of it: getting the app’s HTTPS traffic to land in your proxy as plaintext. And most write-ups get that ten percent wrong, because they were written for an Android that no longer exists. You follow the steps, the cert goes into /system, the app still throws handshake errors, and you conclude the app has exotic pinning. It doesn’t. Google moved the trust store out from under you and the tutorial never noticed.

The richest recon target is a file you already downloaded

Wed, 01 Jul 2026 00:00:00 +0000

Most recon writeups open with a subdomain brute-force and a wordlist. That’s fine, but it’s loud, it’s slow, and it runs before you understand the app. The problem isn’t that people don’t know how to enumerate — it’s that they treat recon as something you go out and do, when the highest-yield artifact is already sitting in your proxy history. You downloaded the whole codebase the moment the page loaded. You just haven’t read it yet.