Today, we’re diving into a topic you’ve probably heard about but might be hesitant to explore in depth: Mimikatz and its advanced…

New PhantomRaven npm malware uses AI "slopsquatting" and invisible dynamic dependencies to steal GitHub, GitLab, and CI/CD tokens. Update vigilance now.

With many new faces in the coding communtiy, one problem has been appearing more and more. Developers hard-code their secrets (API-Keys…

Vulnerability Assessment and Penetration Test Report

There are lots of web app security tools. Some of them are very well known, like BurpSuite, Nmap, Nuclei, ffuf, etc, whilst others, even…

SantaStealer, a new MaaS info-stealer, is being aggressively marketed on the dark web. It's a BluelineStealer rebrand that uses C code and open-source libraries to steal crypto wallets and credentials, despite having amateur anti-analysis features.

Hi everyone, it’s me pr1vacy from Abyssal Hunter.
Today, I’m sharing a write-up on how I turned my recon phase into an AWS and DB…

Credential exposures are one of the fastest paths to compromise. In 2024 alone, GitHub detected over 39M leaked secrets across its…

Halo guys, ini tulisan pertama gw semoga membantu :)

Machine Name: CAP Difficulty: Easy Operating System: Linux Category: Web / Credential Reuse / Linux Capabilities Author: Achraf Nouri Cap is an easy Linux machine that demonstrates several …

Adversaries have once again targeted the npm supply chain, though this incursion pursued a surgical and perilous objective:

Discover the details behind the Microsoft GitHub repository suspension. Learn how malicious scripts targeted AI workflows and compromised cloud secrets.

Discover the recent Meta AI support hack. Learn how attackers exploited the High Touch Support tool to hijack over 20,000 Instagram accounts.