Alpine is an easy difficulty machine. Do you wish to go skiing, or maybe to book a two-night trip to the mountain? Then this linux room is…

Beginner HackTheBox Crocodile machine writeup covering FTP enumeration, web exploitation, credential discovery, and basic penetration…

Complete HackTheBox Archetype machine writeup featuring MSSQL exploitation through SMB enumeration, xp_cmdshell command execution, and…

Scenario

my bitcoin was stolen how can I recover it” Scanner Hacker Crypto Recovery maintains full compliance with all applicable laws and regulations. Their services are conducted with complete …

Introduction
You have probably heard the term “API” before, maybe when using apps like Spotify, Instagram or online banking among others…

Hi, I’m Mohamed Kamal, Offensive Security Engineer and bug bounty hunter

Stop learning 50 tools — master the one that actually finds real money bugs.

Descubre cómo la falla API9 (Improper Inventory Management) expone APIs Zombie y Shadow para un Bypass de seguridad crítico.

⚡Quick Overview

เมื่อไม่นานมานี้ ผมมีโอกาสได้เข้าฟังกิจกรรมที่บริษัทด้านไอทีแห่งหนึ่งเข้ามาแนะนำตัวเอง ว่าทำอะไร รับคนแบบไหน มีโปรเจกต์อะไรน่าสนใจบ้าง…

20+AI Tools for Effective Pentesting and OSINT Research

Link: https://tryhackme.com/room/techsupp0rt1

In the early stages of search, ranking algorithms were easily manipulated through tactics such as hidden text, link farms, and keyword…

A few months ago, a friend told me about something strange that happened while she was checking her bank account on her phone. The page…

Introduction
APIs (Application Programming Interfaces) power almost every app you use today, from social media and banking to fitness…

Google Labs unveils Disco, an experimental AI browser powered by Gemini 3. It features GenTab, which can generate interactive Progressive Web Apps (PWAs) from web content.

New flaws found in React Server Components risk a Server-Crashing DoS (CVSS 7.5) via infinite loop and Source Code Disclosure (CVE-2025-55183). Update to v19.0.3/19.1.4/19.2.3 immediately.

A flaw in Apache Fineract risks Authorization Bypass via IDOR (CVE-2025-58137) in its self-service API, potentially exposing customer data. Also fixed: Weak Password Policy and Unmasked Server Keys. Update to v1.13.0.

New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for access. A curious "lockbit" ignore list was found in the code.

CISA added a critical XXE flaw (CVE-2025-58360) in OSGeo GeoServer to the KEV Catalog. The actively exploited bug allows attackers to read arbitrary files and perform SSRF on internal networks. Patch immediately.