This blog is a walkthrough of the PortSwigger Web Security Academy apprentice labs. I’ve kept the explanations simple and focused on the…

Last month, I stumbled across something that completely shattered my assumptions about tech careers. A 19-year-old kid from Argentina who…

Hey there!😁

Who am I ?

A deep dive into exploiting Server-Side Prototype Pollution in Next.js applications.

A simple IDOR walkthrough you can follow and recommend to others

Today was exciting — because instead of just reading concepts,  I actually stopped an attack inside a simulation.

Panduan lengkap XSS attack (Cross-Site Scripting) untuk ethical hacker, membahas jenis XSS, risiko keamanan web, dan cara pencegahannya

On unauthenticated access, cloud trust boundaries, and why defaults still fail

Why auth ≠ permission, and how logic bugs quietly break real systems

Your app works fine in development.
 Production tells a very different story.

Deep-Dive PII Hunting & Validation Techniques

Why infrastructure sometimes saves bad code (and why I stopped trusting the Repeater tab)

This website has an insecure CORS configuration in that it trusts all origins.

At three in the morning, the router is still awake.

“Please I want to learn how to hack thank you very much what to start with first” is published by z1980h.

Report Prepared By: Achref Habib Rahali
Course: Python For CyberSecurity
Institution: Tekup University

Uncover Next.js Middleware Bypass, internal SSRF, and Remote Radis Command Execution by Analyzing Logs and Forensic Artifacts

Understanding Common OTP Bypass Techniques Introduction One-Time Passwords (OTPs) are widely used to secure user logins, but weak implementation or poor user awareness can still expose systems to …

Emails, names, courses, CPF (tax identification number), mother’s name, date of birth… Better stop here, right?! In this security article…

Emails, nomes, cursos, CPF (identificação fiscal), nome da mãe, data de nascimento… Melhor parar por aqui, né?! Nesse artigo de segurança…