Pentester Bypasses Security with Null Byte Injection

0xold, a seasoned penetration tester, shares two vulnerabilities discovered using null byte injection. The first involved a password reset callback URL parsing issue; injecting the Unicode null byte character `\u0000` bypassed restrictions, allowing partial control of the callback URL. The second was a path traversal to XSS. Fuzzing revealed a `templatename` parameter; null byte injection and a custom wordlist led to successful XSS exploitation. Furthermore, null byte injection bypassed an internal WAF, enabling SQL injection.