PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Graphtage: A New Semantic Diffing Tool

blog.trailofbits.com | blog | #open-source | #tooling | #json | #xml | #yaml | #file-formats | #diff | #semantic-diff | #toml
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Graphtage is a semantic diff tool for tree-structured files such as JSON, XML, and YAML: unlike line-oriented diff, it matches unordered structures and even compares across formats.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Unexpected security footguns in Go's parsers
Unexpected behaviors in Go's JSON, XML, and YAML parsers let attackers bypass authentication, evade authorization, and exfiltrate data—seen in HashiCorp Vault's CVE-2020-16250 and real engagements.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
blog · netspi.com
Playing with Content-Type – XXE on JSON Endpoints
By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.
research · volexity.com
Go Get ‘Em: Updates to Volexity Golang Tooling
# Go Get ‘Em: Updates to Volexity Golang Tooling August 11, 2025 Ivan Mladenov _This blog post was the final deliverable for asummer internship project, which was completed under the direction of...
blog · blog.trailofbits.com
SAML: A fractal of bad design
Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
Back