jub0bs.com

If you’ve always been curious about how hackers identify and exploit vulnerabilities in Web applications, look no further than this course.

This course serves as an introduction to generics and iterators, two closely related features of the Go programming language.

Under construction

This short course (recently refreshed for Go 1.26) aims at demystifying Go’s main concurrency features: goroutines, channels, mutexes, select statements, and contexts.

Conference talks ¶ Useful Functional-Options Tricks for Better Libraries (GopherCon Europe 2023) Seven Git tips & tricks (RebelCon 2017) Meetups ¶ GopherCon EU Speaker Panel (GDG Berlin Golang, Jun. 2023) Property-based Testing (CorkDev, Feb. 2017) Podcas…

I am a contributor to the Go project.

If you have programming experience with another language and would like to get started with Go, look no further than this course (recently refreshed for Go 1.26).

TL;DR ¶ Go has now standardised iterators.

In this post, I challenge you to refactor a small Go function in such a way as to make it inlinable and free of bounds checks, for better performance.

TL;DR ¶ Exported concrete error types are superior to sentinel errors.

TL;DR ¶ Some of the wisdom contained in Josh Bloch’s Effective Java book is relevant to Go. panic and recover are best reserved for exceptional circumstances.

TL;DR ¶ jub0bs/cors v0.5.0 now lets you handle CORS-configuration errors programmatically.

TL;DR ¶ In this short follow-up to my previous post, I describe why and how I’ve added support for dynamic reconfiguration of CORS middleware in jub0bs/cors.

TL;DR ¶ I’ve just released jub0bs/cors, a new CORS middleware library for Go, perhaps the best one yet.

TL;DR ¶ A few months ago, while hunting on a public bug-bounty programme, I found a nice little bug chain that involved an insecure message event listener, a shoddy JSONP endpoint, a WAF bypass, DOM-based XSS on an out-of-scope subdomain, a permissive CORS

TL;DR ¶ In this post, I investigate why developers struggle with CORS and I derive Fearless CORS, a design philosophy for better CORS middleware libraries, which comprises the following twelve principles: Optimise for readability Strive for a simple and c…

TL;DR ¶ In this post, I present an XSLeak technique that allows an active network attacker to observe, from an insecure Web origin, the presence or absence of some Secure cookie that may have been set by the origin’s secure counterpart.

James Kettle’s 2016 research was instrumental in raising awareness of the deleterious effects of CORS (Cross-Origin Resource Sharing) misconfiguration on Web security.

This post is a writeup about CVE-2022-21703, which is the result of a collaborative effort between bug-bounty hunter abrahack and me.

In this post, I show how a malicious member of a Slack workspace can exploit a cross-site leak in Slack’s file-sharing functionality in order to efficiently de-anonymise fellow workspace members when they visit the attacker’s website in Chromium-based bro…

My third guest post on Honeybadger’s blog, entitled Subdomain Takeover: Ignore This Vulnerability at Your Peril has just been published!

In this post, I dissect a common misconception about the SameSite cookie attribute and I explore its potential impact on Web security.

My second guest post on Honeybadger’s blog, entitled Protecting Your Apps From Link-based Vulnerabilities: Reverse Tabnabbing, Broken-Link Hijacking, and Open Redirects has just been published!

TL;DR ¶ To familiarise myself with the updated design draft on Type Parameters in Go, I wrote a generic implementation of a bidirectional map.

A server-side request forgery (SSRF) is a type of vulnerability that consists in tricking a server into sending network requests to unintended hosts.

I recently stumbled upon a critical instance of broken-access control, and I thought its story would make for an interesting blogpost.

Julien Cretel I’m Winston Wolfe; I solve problems. security testing (vulnerability assessments, penetration tests, code audits) freelance software developer Golang trainer (through both English and French) self-diagnosed misophonia sufferer cheese lover h…

My first guest post on Honeybadger’s blog, entitled Plugging Git Leaks: Preventing and Fixing Information Exposure in Repositories has just been published!

(This post is also available in French on Human Coders' blog.)

Go supports multiple programming paradigms, including object orientation.

defer, in a nutshell ¶ When learning Go, one quickly comes across the defer keyword.