Developers use regex as a security gatekeeper. Your job is to find the cracks in the logic, slip through, and turn their validation into…

Zomato Billionaires Sensitive Financial info leak was reported on Hackerone but company was quick to close the report as they do always.

TASK 1 What is an IDOR?

Authorization bugs rarely announce themselves. They do not crash applications or trigger obvious errors. Most of the time everything…

ARP spoofing & Man In The Middle Attacks Execution & Detection

The cryptocurrency revolution promised financial freedom and anonymity, but it has also given rise to a shadow industry of fraud that…

Hacking the “Cave”: A Web-Application Penetration Testing Writeup

Introduction

My Name is Bineeg, and this time I want to discuss an Android application pentest hurdle I have faced.

A weird thing happened in January 2026: a PowerPoint bug from 2009 showed up again on a government “actively exploited” list.

Nmap (Network Mapper) is an open-source tool used to discover hosts and services on a network. It answers two fundamental questions in…

Can you combine your great nmap skills with other tools to log in to this machine?

There was a time when securing an application meant securing a screen. You worried about login pages, form validation, and maybe a firewall…

I never imagined that a simple click could wipe out everything I had worked for — my entire $450,000 crypto portfolio vanished in minutes…

PDF generators are widely used in modern web applications to automatically create documents such as invoices, receipts, tickets, reports…

As usual, even though I hate it, it’s been a long time since my last post. In the same vein, I’m not here to “reinvent” the wheel. I’m just…

Security disasters rarely arrive with sirens.

Disclaimer:  This research was conducted responsibly, in good faith, and coordinated through CERT/CC. No sensitive details, exploit…

For a long time, I thought XSS needed input fields or query parameters.