Browse / Bypasses

The bypass library

Reports where a researcher got past a protection, grouped by what they got past. 2,170 cases across 18 kinds of protection, drawn from the write-ups on this site.

• Login and identity checks392 reportsAuthentication, SSO, session and password-reset checks
• Authorisation and access checks296 reportsPermission, role, ownership and paywall checks
• Other protections257 reportsBypasses of checks that fit none of the groups above
• Earlier fixes256 reportsReports that got past the fix for an earlier report
• Input filters and sanitisers207 reportsBlocklists, HTML sanitisers, escaping and tag or attribute stripping
• Two-factor and verification codes127 reports2FA, OTP and code checks that can be skipped, reused or guessed
• SSRF protections94 reportsHost allow-lists, internal-address blocks, redirect and DNS checks on outbound requests
• Web application firewalls87 reportsCloudflare, Akamai, ModSecurity and other request filters in front of the app
• Rate limits and lockouts81 reportsThrottling, attempt limits, lockouts and CAPTCHA
• Content Security Policy79 reportsScript and resource policies, nonces and allow-listed hosts
• CSRF protections56 reportsTokens, SameSite cookies, and Origin or Referer checks
• Same-origin and CORS rules53 reportsOrigin allow-lists, CORS headers and same-origin policy gaps
• Path and encoding checks50 reportsPath normalisation, traversal filters and encoding tricks
• Email and phone verification48 reportsConfirming an address or number before it is trusted
• URL and redirect validation38 reportsredirect_uri checks, host validation and URL parser differences
• File upload checks20 reportsExtension, content-type and file-content validation
• Sandboxes and execution limits16 reportsIframe sandboxes, restricted interpreters, jails and disabled functions
• Token and signature checks13 reportsJWT, HMAC, signature and API token validation

Reports are sorted into these groups automatically, from their titles and from the sentences that describe a bypass, so a few will be misfiled.