Filtros parecem apenas query params, mas envolvem validação, segurança, autorização, performance, paginação, cache e consistência de…

ShinyHunters hackers defaced the official Canvas LMS portal after breaching Instructure systems, disrupting university access worldwide.

Hi, I’m mrx_w_ (Adem Ziane Berroudja), a bug bounty hunter on Bugcrowd. You can find me on Twitter and LinkedIn under mrx_w_. In this…

How CrowdStrike Outran SentinelOne While Running the Same Race CrowdStrike now generates roughly five times the revenue of SentinelOne, trades at five times the EV-to-revenue multiple, and commands a …

Pentesting is as much about the process as it is about the tools we use. What a successful engagement really comes down to is how thorough…

After spending some time on Modules I decided to take a chip at a challenge and this caught my eye :)

Disclaimer: This walkthrough was performed in a controlled lab environment for educational and authorized security testing purposes only.

Dirty Frag PoC released! Researcher v4bel discloses a universal Linux root exploit targeting the page cache. No patches yet—apply module mitigations now!

Rancher Fleet fixes a 9.9 CVSS flaw (CVE-2026-41050) allowing tenants to bypass ServiceAccount isolation and steal secrets. Upgrade your GitOps engine now!

Zabbix fixes high-severity XSS (CVE-2026-23926) and Oracle injection flaws. Don't let your monitoring tool become a backdoor—upgrade your Zabbix server now!

{وَآتَاكُم م كُلِّ مَا سَأَلْتُمُوهُ ۚ وَإِن تَعُدُّوا نِعْمَتَ اللَّهِ لا تُحْصُوهُ ۗ }

An educational deep dive into mobile application security assessment, reverse engineering, and the illusion of security through obscurity.

Authentication mechanisms are often heavily protected against brute-force attacks on the main login page. However, developers sometimes…

⚠️ Disclaimer ⚠️ This write-up is for educational purposes only. It is meant to explain the thought process and steps taken to solve the…

Theory

“Saat pentest web, masalah terbesar bukan langsung cari celah.
Tapi… kita bahkan tidak tahu semua endpoint yang ada di aplikasi itu.”

Lets start off with a nmap scan against the target:

A deep dive into the recent canvas hack, the rise of pixel-perfect botnets, and how the internet community is fighting back.

CVSS 9.3. No authentication. No patch until May 13. And Unit 42 has confirmed a likely state-sponsored threat actor has been exploiting…

🧠 Introduction

Introduction