Hi, I’m Mohanraj and CSE grad . I’m a Security Analyst at a Big4 doing VAPT. Apart from my work, I also develop Web2 and Dapps/ Web3…

Certified, Active Directory Certificate Services (AD CS) yapılandırma hataları ve karmaşık Access Control List (ACL) zafiyetleri üzerine…

A file upload filter that feels solid — until you realise the server feeds your zip directly into headless Chrome. What started as a search…

Aşama 1: Keşif ve Bilgi Toplama (Enumeration)

Puppet is a mini prolab by VulnLab that provides hands-on experience with the Sliver command and control framework.

Sidecar is a mini prolab by VulnLab involving .lnk abuse, AV bypass, WebDAV abuse, password spraying, and TcbPrivileges abuse.

Adım 1: Keşif ve Bilgi Toplama (Reconnaissance)

Introduction

Machine: TombWatcher
Difficulty: Hard
Category: Active Directory | ACL Abuse | ADCS | BloodHound
Status: Active (Season 8)

HTB Retro MachineWriteup: Retro (Active Directory) Adım 1: Keşif ve Bilgi Toplama (Reconnaissance) Operasyona klasik olarak hedef sistemdeki açık portları ve çalışan servisleri tespit etmek …

Introduction

Building My First Wazuh SIEM Home Lab for SOC Practice

The transition from a Vulnerability Assessment and Penetration Testing (VAPT) report to a concrete business risk calculation is often where…

organized by — Crypto Forensics Technology.

You validated everything that came from your users. Did you validate everything that came back from your vendors?

Your team hardened the current API. The attacker found the old one.

While testing a web application during my internship, I came across an interesting API endpoint:

How small contract changes in events, APIs, and data pipelines quietly turn into auth gaps, logging blind spots, and policy failures.

Not a clever exploit. Not a logic flaw. Just the things nobody remembered to lock.

The attacker doesn't attack your server. They convince your server to attack itself.