In previous articles, we’ve already covered what Server-Side Request Forgery (SSRF) is. In this post, we’ll look at how open redirects can…

We have already looked at Server-Side Request Forgery (SSRF) and found that exploitation usually relied on one key advantage: visibility…

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Free Link

WordPress Security Assessment & Penetration Testing Report

Hey there, back again with another post! 😄

Image XSS ATTACK on Exif.tools | Hacking exif.tools via image injection by CYBER KALKI #Livepoc (Rewriting Deleted article originally published in oct 2025) I uncovered and demonstrated a …

This issue came from an endpoint that looked completely harmless. It was a download API that fetched a URL on the server and returned the…

This is a description of the steps I took to solve the Infinity Learning lab: Function’s Backdoor Route [1]. It is classified as a hard…

Summary

ARP spoofing & Man In The Middle Attacks Execution & Detection

Security Onion is a powerful open-source platform for network security monitoring, intrusion detection, and log management, widely used by…

Exposing services directly to the internet still comes with significant risk, even today. To better understand real-world attack behavior…

Android Pentesting Series

A real end-to-end lab engagement: recon → credential discovery → share abuse → lateral movement → multi-host compromise → reporting

TripBFF exposed recent live latitude & longitude data and birth date for every user on their platform

Understanding Broken Authentication Through Exposed JavaScript Logic

Introduction

Challenge Scenario