TA AzeezCode

Security case studies

From vulnerability discovery to verified remediation

These case studies demonstrate how I approach application security end to end: understanding context and scope, reproducing the issue, identifying the root cause, assessing impact, implementing or recommending remediation, and retesting the fix.

01 · Identify

Understand the application, trust boundaries, attack surface and expected security behaviour.

02 · Validate

Reproduce the weakness safely and determine the conditions required for exploitation.

03 · Remediate

Trace the root cause and develop practical remediation that addresses the underlying security flaw.

04 · Retest

Repeat positive and negative security tests to verify the fix without breaking legitimate behaviour.

high severity Access control

IDOR: missing server-side authorisation in an invoice workflow

An authenticated user could modify an invoice identifier and attempt to access another customer's resource. The remediation enforced ownership at the database query layer and was verified with positive and negative authorisation tests.

IDOR Broken Access Control Authorisation PHP

5 min read

high severity SSRF

SSRF in a server-side document import feature

An authorised security lab examining how a user-controlled URL can cause a web server to make unintended requests to internal or restricted destinations, followed by layered remediation and retesting.

SSRF Web Security PHP Input Validation

9 min read

high severity XXE

XXE in a legacy XML import parser

A supplier feed parser resolved external entities, exposing server-side file contents. Remediated by disabling entity loading, switching to a safe parser configuration and validating against a schema.

XXE Secure parsing Legacy code Retested

2 min read

high severity File upload

Secure file-upload implementation review

A document upload feature trusted the client supplied content type and stored files inside the web root. Rebuilt with type verification, random storage names, out-of-root storage and authorised download.

File upload Secure design Access control Retested

2 min read

medium severity CSRF

CSRF protection for sensitive account changes

Email and password change endpoints accepted cross-origin form posts. Remediated with synchroniser tokens, SameSite cookies, re-authentication and change notification.

CSRF Session security Account takeover Retested

2 min read

medium severity Authentication

Session fixation prevention on login

The session identifier survived authentication, allowing a pre-set identifier to become an authenticated session. Fixed by regenerating on privilege change and hardening cookie attributes.

Session fixation Authentication Cookies Retested

2 min read

Responsible testing & publication policy

Case studies on this portfolio come from authorised training environments, personal labs, secure-development projects and sanitised professional experience. Testing is performed only where I have permission or within environments specifically designed for security training.

Client names, private hostnames, customer records, credentials, API keys, authentication tokens and sensitive implementation details are not published. Commercial findings are generalised where necessary to protect confidentiality while preserving the security lesson, root cause and remediation approach.

My focus is not simply demonstrating that a vulnerability can be exploited. I document why the weakness exists, how it affects the application, how it should be remediated and how the remediation can be verified.