Carl Sampson — Application Security Researcher

I’m a security researcher and application security engineer focused on vulnerability research, web security, and building tools to make application security easier. I founded the OWASP Indianapolis Chapter in 2005 and curate appsec.fyi, a collection of application security resources.

I’m a Senior Security Researcher on the Azure DevSec team at Microsoft, where I hunt SSRF and other web vulnerability variants across the Azure ecosystem. Before that I worked at Proofpoint, Salesforce, Teradata, and Anthem. On my own time I do memory-safety research in C/C++ media software — a use-after-free I found and patched shipped in Kodi v22, and I’m credited in an upstream FFmpeg fix. I’ve spoken at DerbyCon and CircleCityCon on topics like extending Burp Suite and Ruby security.

More about me →

Featured Work

🚀 Application Security Guides

In-depth references for the vulnerability classes I work with most — XSS, SQLi, SSRF, IDOR, RCE, deserialization, API and mobile security — each covering attack surface, exploitation, and defense.

Browse the guides →

📈 Most-read guides

The pages people actually come here for:

🔑 IDOR - finding and exploiting broken object access, with a testing checklist
💰 Bug Bounty Methodology - my recon-to-report workflow
🕵️ Leaked Secrets - Google and GitHub dorks for API keys and tokens
🧪 JWT Attack Playground - forge and break tokens in your browser

📝 Latest post

Security Topics

Explore by vulnerability class:

🔐 Authorization & Access Control - IDOR, BOLA, BFLA & building an authz layer that holds
🎯 SSRF (Server-Side Request Forgery) - Complete prevention guide
⚡ XSS (Cross-Site Scripting) - Defense strategies & CSP implementation
🐍 Python Security - Secure development practices

Recent Posts