Category: Web
 Tech: Node.js, Express, MongoDB, Mongoose, TOML
 Goal: Get RCE
 CTF: blackhat-finals

Last month, after losing a significant amount of cryptocurrency to a scam, I turned to Optimistic Hacker Gaius for help. Their team was…

If you look at how cybersecurity has evolved over the past few years, one thing becomes very clear: we finally have the horsepower to see…

Introduction

Day 7 shifts the spotlight from endpoints and logs to something more fundamental: the network itself.

Building a 24-skeleton adversarial framework that adapts to GPT-4o, Claude, and Grok.

As I wrote in my last blog post, different industries take different approaches to providing guidance to everyday people. What would it…

Gözle göremediğimiz dijital sırların kapısını aralamaya hazır mısınız?

Identifying all top-level domains (TLDs) associated with a target is a critical part of recon in bug bounty hunting. Many organizations…

There are days in bug bounty hunting when you stumble across something tiny — almost too simple — and yet it reminds you exactly why web…

Some bug bounty stories start with clever payloads, boundary-pushing exploits, or hours of reverse engineering.

Spatial awareness is a core OSINT skill most overlook.

Hello, and thank you if you’re one of the few tech savvy, interested in HackTheBox reading this. This is one of the series that I’ve…

That free coffee shop Wi-Fi isn’t just slow — it’s a hacker’s playground. Here is your survival guide to locking down your connection…

In 2026, blockchain is no longer a niche innovation quietly maturing in the background of digital finance. It has become both a global…

Think of it like a magic mailbox. Anyone can drop a letter in, but only you have the key to open it. The mailbox actually has two keys…

Complete Walkthrough & Learning Guide

The BlueShrimp exploit targets a Bluetooth UAF flaw (CVE-2025-48593, CVSS 8.0) that can crash the service on Android Automotive and Wear OS. Phones are safe, but PoC is public. Patch immediately.

A High-severity flaw (CVE-2025-13654) in the Duc disk usage tool risks DoS and information leaks. An integer underflow in buffer.c allows out-of-bounds memory read. Update to v1.4.6 immediately.

A dangerous new Android malware called SeedSnatcher targets crypto users with overlay phishing on MetaMask/Trust Wallet. It uses BIP 39 validation to steal seed phrases and supports remote command execution for total device control.

Volexity exposed Russian APT UTA0355 using fake security conference sites and WhatsApp support to trick victims. The attacks steal Microsoft 365 OAuth and Device Code tokens for persistent access.