Microsoft is Killing the Azure Portal for Sentinel — Here’s What Your Team Needs to Know About Permissions

We like to imagine cybersecurity as a digital fortress. Firewalls stacked on firewalls. Encryption wrapped in encryption. Somewhere, a…

If you’re celebrating the arrival of a new year, you’re not alone. The party mood outside feels like a fresh start and a clean slate. But…

During a recent security assessment, I identified a Boolean-based blind SQL injection on a live application endpoint: /CMS/GetMarqueeData

No exploits. No malware. No brute force. Just exposed APIs, missing authorization checks, and a clear path from visitor to admin.

Go beyond basic lookups — leverage DNSRecon to expose deep infrastructure insights.

Your first step into the world of DNS enumeration and cybersecurity reconnaissance.

Spoof User-Agent headers and learn why client-controlled data can’t be trusted for security

Cron is one of the most trusted tools on a Linux system.

When the firewall stopped playing nice

Category: Forensics | Difficulty: Hard | MITRE ATT&CK TTPs (Potential Alignment): TA0001, TA0005, T1190, T1027.010

E-commerce applications are widely used, but many of them still suffer from serious security issues. One very common vulnerability is price…

How I used simple math to read NASA’s press releases before they were published an IDOR case study on WordPress.

MCP servers turn an LLM from a text generator into an actor: they can read data, call APIs, touch files, and sometimes run commands. That…

1 january 2026 12:4

As a security researcher, one of the most satisfying finds is a zero-click vulnerability something that executes malicious code the moment…

Why modern WAFs fail against “Read-Modify-Write” exploits in Java architectures.

DISCLAIMER: FOR EDUCATIONAL(AND NOSTALGIA) PURPOSES ONLY

ARP spoofing & Man In The Middle Attacks Execution & Detection

In Part 1, we kicked down the front door by exploiting weak file permissions on /etc/shadow. But in my recent Red Team engagements, I’ve…