The Code Log
Welcome to my blog, a space where I share insights, lessons, and best practices from building secure, scalable web applications and SaaS solutions. From tackling complex development challenges to exploring modern tools, frameworks, and security techniques, this is where I document what works, what doesn’t.
SSRF in Laravel: How a 'Fetch Banner from URL' Feature Bridges Into the Internal Network
A blog editor's 'fetch banner from a URL' shortcut calls Http::get() on whatever you type, with no scheme, host, or IP checks, so an admin session becomes a free port scanner for the internal Docker network. Each error that comes back is an oracle: an empty reply means Redis, a refused connection means a closed port, and a clean 200 means you can read whatever's on the other end. Pair it with Post 1's mass-assignment bug and Redis is one polite form field away, no shell required.
Stored XSS in Laravel: No Account Needed When the Sink Is the Admin's Own Session
You don't need a login to plant this one. A message left through a public contact form sits quietly in the database until an admin opens the page to review submissions, then wakes up and runs inside their session, no password stolen, no cookie needed.
Livewire File Upload Bypass: Smuggling a PHP Shell Past MIME Validation
The file upload validator checks the extension and rejects .php. The MIME validator asks the browser what type the file is. The browser says image/jpeg. The server trusts it. The file, a PHP webshell with a .php extension inside a polyglot wrapper, lands in a publicly accessible directory.