XSS walkthrough using reflected and stored payloads in TryHackMe’s AOC 2025 Day 11.

Solve TryHackMe’s AOC 2025 Day 17 room using CyberChef!

In this guide, we will break down the RootMe room from TryHackMe. This lab is a fantastic introduction to web exploitation, file upload…

The story continues, and the elves mount a rescue and will try to breach the Quantum Fortress’s defenses and free McSkidy

Messy write ups cause I never did one before but I just wanted to put this here cause I was FRUSTRATED with how stupid I am doing the…

In In December 2025, Stanford researchers ran a “Man vs. Machine” contest to see whether autonomous AI agents could outperform…

I've been hit with a sharper awareness of API security more than ever. Not in a dramatic way, but in a practical, everyday sense. APIs…

A real bug bounty case showing how a password reset token was leaked to a third-party analytics service, leading to account takeover

Several weeks ago, I was commissioned by a major financial consortium to advise on a recent security breach. The organization operated…

🎯 Challenge Information

People often think hacking is extremely difficult. In reality, a lot of hacking — especially against poorly maintained websites — is very…

What is Broken Authentication?

Summary

A complete breakdown of my strategy, lab methodology, and the mindset shift required to conquer the PWK-200

Overview

As I began exploring API security, one thing quickly became clear: APIs now power nearly 83% of all internet traffic, quietly driving…

Essentially, this is saying that a web app, will have a database. The database holds the information for the web app. So for example, if…

OWASP publishes the API Security Top 10 list, which highlights the most critical API vulnerabilities. In the latest edition, Broken Object…

I’ve always thought CyberChef had one of the coolest nicknames in security: the Cyber Swiss Army Knife. Day 17 of Advent of Cyber 2025…

Welcome back to NINI’S SIMPLE GUIDE TO API SECURITY.

In this article, I’ll be trying some security checks on the Vulnerable Application in Postman.