https://hansmach1ne.github.io/Mateo Hanžek's Security blogPentesting & security research blogspot. 2026-06-04T01:13:04+00:00 Mateo Hanžek https://hansmach1ne.github.io/ Jekyll © 2026 Mateo Hanžek /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png Case study: Attacking Ajenti Control Panel Authentication2026-01-21T03:00:00+00:00 2026-06-04T01:12:26+00:00 https://hansmach1ne.github.io/posts/case-study-ajenti-control-panel/ Mateo Hanžek The new “Case study” blog series is aimed to present security research for a particular software, protocol or system. Its purpose is to demonstrate how a single, average but a dedicated attacker might approach a certain attack surface. The blog series will focus on critical issues, such as pre authentication and privilege escalation vulnerabilities. The first blog in the series relates to Ajen... CSRF in GraphQL and REST APIs - Attack and defend JSON endpoints2025-07-23T18:26:00+00:00 2026-02-27T01:23:48+00:00 https://hansmach1ne.github.io/posts/csrf-attacks-in-json-endpoints/ Mateo Hanžek This blogpost explores how CSRF attacks can be executed against JSON-based endpoints, the role of SOP/CORS preflight mechanism and bypasses that allow attackers to exploit endpoints expecting JSON content. Cross-Site Request Forgery (CSRF) remains a high severity web security issue, even in the modern APIs that rely mostly on JSON in the request body. While Same-Origin policy (SOP) and Cross-O... Chrome Referrer-Policy override Cross-Site data leak and strict CSP bypass2024-08-09T04:01:00+00:00 2026-01-21T17:34:51+00:00 https://hansmach1ne.github.io/posts/chrome-refferer-policy-override/ Mateo Hanžek One of discoveries of this research was that it is possible to chain few functionalities and misconfigurations together in order to achieve Cross-Site (XS) leak with HTML injection, while strict Content-Security-Policy (CSP) is present. This abuse is possible due to the Chrome following RFC strictly. Specifically, if a site uses forms to send user-supplied data, the usual CSP directive to pre... Weaponizing lesser known event handlers for XSS2024-02-27T00:00:00+00:00 2024-02-27T00:00:00+00:00 https://hansmach1ne.github.io/posts/weaponizing-lesser-known-event-handlers-for-xss/ Mateo Hanžek In the ever-evolving landscape of cybersecurity, one threat remains a persistent adversary - Cross-Site Scripting (XSS). Despite many efforts to mitigate XSS vulnerabilities, hackers continually find new ways to exploit them. In this blog post, we delve into the realm of XSS exploitation through event handlers, exploring cutting-edge techniques that challenge traditional defenses. XSS occurs wh...