This write-up covers the exploitation of a Broken Access Control vulnerability via JWT (JSON Web Token) manipulation.

Love at First Breach 2026

I cleared the SEC1 exam yesterday and wanted to share a few honest notes that might help others preparing for it.
This is not a…

A comprehensive penetration testing guide for the TryHackMe “Internal” machine, covering reconnaissance, WordPress exploitation, SSH…

Author: Tsar Ahmad Alkhowarizmi Platform: picoCTF Kategori: Digital Forensics / Steganography

Learn practical passive and active techniques to discover subdomains, map hidden assets, and safely expand the attack surface of a target…

Lab: Limit overrun race conditions

📌 Challenge Overview

LFI exploit leads to admin key and database flag retrieval.

## Introduction

In today’s digital world, cybersecurity has become one of the most important fields in information technology. With the increasing use of…

Lately, I’ve been constantly checking social media platforms like “X” or “Twitter.” For some reason, it’s been really exciting to check X…

Yapay zekalar herşeyi biliyor ama herşeyi söylemiyorlar. Etik kurallar , güvenlik duvarları ve kısıtlamalar… Peki bir yapay zekaya uyması…

Pendahuluan

Introduction Insecure Captcha adalah salah satu fitur latihan keamanan di Damn Vulnerable Web Application (DVWA) yang menunjukkan bagaimana…

In the hands of a curious mind, Google transforms from a simple search engine into a powerful reconnaissance tool — thanks to the technique…

Hello and welcome everybody!

So, the other day after another impotent SQA role interview session where I failed to implement a problem solving in Python code — out of…

When I first dipped my toes into API Pen-Testing, I assumed attacking an API would feel just like testing a website, only with fewer…