This lab uses the Freemarker template engine. It is vulnerable to server-side template injection due to its poorly implemented sandbox. To…

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

By Troy Wojewoda During a recent Breach Assessment engagement, BHIS discovered a highly stealthy and persistent intrusion technique utilized by a threat actor to maintain Command-and-Control (C2) within the client’s […]

A practitioner’s guide to sustainable web security testing

A critical React vulnerability, an industry-wide scramble, and the lesson: respond fast — without breaking production.

What does the recent rise in attacks using AI mean for the future of security testing?

The Story

McSkidy keeps her focus on a particular alert that caught her interest: an email posing as northpole-hr.

Understanding the Gibberish

タイトル通り、まさにこれです。この目的のためにスクリプトを作成しましたので、手順に従っていただければスムーズに動作するはずです。

It’s a reminder of how modern apps are quietly becoming attack surfaces.

The goal of this post is to explore the nature of polyglot files and the scenarios where they are most effective for discovering…

HTB MonitorsFour Writeup

Everything you need to know about CVE-2025–55182 — how it works, who’s exploiting it, and what you must do right now

If you’ve ever tried to use wordlistctl on Kali Linux, you may have noticed it’s not as straightforward as just running apt install…

Advent of Cyber Day 5 shows how IDOR bugs leak data.

Advent of Cyber 2025 Day 18 walkthrough on obfuscation techniques.

Learn encoding & decoding using CyberChef, and about HTTP headers.

Complete Walkthrough & Learning Guide