Bug Class Deep Dives on Crusader Research

SSRF past the easy filters: URL-parser confusion and the metadata endpoint

Sun, 05 Jul 2026 00:00:00 +0000

Server-side request forgery is one of the few bug classes where a single finding hands you cloud credentials. The mechanic is trivial to state — you make a server fetch a URL you control — and every write-up stops there, which is exactly why they’re useless. The tutorial payload, http://169.254.169.254/ pasted into a URL field, has been blocklisted everywhere. The reason SSRF is still one of the most productive bug classes in 2026 isn’t that developers forgot to filter. It’s that their filter and their HTTP client read the URL differently, and you live in the gap.

Winning web race conditions with the single-packet attack

Sun, 05 Jul 2026 00:00:00 +0000

Most write-ups tell you a race condition is a “timing window between check and use.” True, and useless — because the reason your race attacks fail isn’t that you don’t understand the concept. It’s that the window is smaller than the internet is precise.

A typical race window — the gap between an app reading balance and writing balance - amount — is measured in microseconds to a few milliseconds. The jitter between two HTTP requests you send at the same instant, by the time they arrive and get scheduled on the server, is routinely 1 to 10 milliseconds, and worse across the public internet. So your “simultaneous” requests arrive in a neat little line, the server processes them one at a time, the limit holds, and you conclude the endpoint is safe. It isn’t. You just lost the race to network jitter before the server ever got a vote.

IDOR lives in the second identifier: finding BOLA with two-account Shadow Replay

Sat, 04 Jul 2026 00:00:00 +0000

Every IDOR tutorial hands you the same drill: find /api/orders/48210, change it to 48211, look for a 200. That drill trains you to attack the one identifier the application is most likely to check. The primary key in the URL path is where the framework’s @authorize annotation lives, where the ORM scopes the query, where the review focused. It’s the honeypot. You fuzz it, get 403s, call the endpoint safe, and walk right past the bug.