This box is ranked hard difficulty on THM, it involves us decrypting a special string which grants us SSH creds to the system. Then, we…

Episode 1 — The Calendar That Knew Too Much,

Summary

This guide is strictly for educational purposes only. All demonstrations are performed in a controlled environment using Metasploitable 3…

Hi, this is Spoof (or Spoofey, as you like).  In this write‑up, I’ll explain how I solved a simple web challenge on Hack The Box using…

Overwriting Accounts via Android Signup Logic Flaw

Hey there!😁

“Security is often just an illusion — and I’m mr0x1_, the guy who likes to break the spell. Come along as I show you how I chained a…

Exploiting about 40 vulnerabilities on a vulnerable bank APIs, and documenting every step to help professionals with an API test…

Overwriting Accounts via Android Signup Logic Flaw

“Security is often just an illusion — and I’m mr0x1_, the guy who likes to break the spell. Come along as I show you how I chained a…

By: A Full-Time Hacker Who Believes in Passive Recon

by vishal raj . January 04, 2026

What is Hydra?

Each year, I carve out a few weeks during the holiday break to tackle house chores and dive into some “nerd projects.” This year is no…

2025 was a year of smart contract exploits. Protocols that passed multiple audits, protocols that had been battle-tested for years…

By: An Experienced Pentester Who Turned Skills Into Streams

Facing off with Gandalf Level 3 Thank you for reading my post, this blog post was written by me with assistance from ai to edit and improve word choice. Having conquered the first two levels, I …

Why “Context” is the most important word in web security, and why your .replace('<', '<') function isn't enough.

How simple logic mistakes turn discounts into real money losses