TECHNICAL RESEARCH & ANALYSIS
Security Research & Advisories
Deep-dive technical articles, vulnerability analysis, and security engineering insights authored by RajSecure’s offensive research team.
Dissecting Broken Object-Level Authorization (BOLA) in Modern Microservices
Why automated DAST scanners fail to catch BOLA (OWASP API1:2023), how complex UUID/tenant boundaries are bypassed, and practical architectural patterns for bulletproof server-side access control.
Key Takeaways:
- Why object GUIDs do not replace authorization checks
- Scoped ORM query resolvers vs. imperative if-checks
- Automated integration testing for IDOR/BOLA regression
Anatomy of AWS IAM Privilege Escalation Chains: From IMDS to AdminAccess
Analyzing real-world attacker paths chaining SSRF vulnerabilities with over-permissive IAM instance profiles, PassRole policies, and Lambda executions to achieve full cloud environment takeover.
Key Takeaways:
- IMDSv1 vs IMDSv2 token protection mechanisms
- The danger of unconstrained iam:PassRole permissions
- Implementing Service Control Policies (SCPs) to bound blast radius
Indirect Prompt Injection & Data Exfiltration Vectors in Enterprise RAG Systems
How untrusted documents in vector databases manipulate LLM reasoning, extract confidential system prompts, and execute unauthorized tool calls in multi-tenant enterprise knowledge architectures.
Key Takeaways:
- Indirect prompt injection attack mechanics
- Vector database tenant isolation vulnerabilities
- Human-in-the-loop sandboxing for agentic tool execution
Subdomain Takeovers in Modern Cloud Stacks: S3, GitHub Pages, and CNAME Hygiene
How dangling DNS CNAME records point to deleted cloud assets, allowing attackers to claim domains, intercept session cookies, and bypass OAuth redirect URI security controls.
Key Takeaways:
- Automated detection of dangling DNS pointers
- OAuth redirect URI hijacking risks
- Terraform and DNS lifecycle synchronization
Common OAuth2 & JWT Implementation Vulnerabilities in SaaS Platforms
Examining subtle flaws in JWT signature verification (`none` alg, JWKS spoofing, symmetric key confusion) and OAuth2 state/PKCE implementation weaknesses in B2B authentication flows.
Key Takeaways:
- Strict JWKS URL whitelisting and asymmetric signing
- Token revocation strategies in distributed systems
- PKCE validation for single-page and mobile applications
Building an Effective Vulnerability Remediation Pipeline with Measurable SLAs
Moving from vulnerability report chaos to structured engineering sprints: risk-weighted triage, realistic remediation timelines, and automated retest verification.
Key Takeaways:
- Defining risk-based SLAs for Critical, High, and Medium flaws
- Bridging communication between security researchers and developers
- Verification retesting as a quality gate before production deployment
Looking to Evaluate Your Own Attack Surface?
Our research principles are directly applied during every client penetration test and security review.