It’s Not a Hollywood Hack It’s Boring, Patient and Starts with Public Information

An attack which shook the software industry!!!

Pre-Engagement → understand the scope/contract
Info Gathering → recon, find targets
Vulnerability Assessment → find weaknesses
Exploitation…

Introduction

Introduction

30 days. Public. Still going.

The API security flaw that gives away too much and accepts even more. The idea for this blog from APISec University.

I. The Geometry of the Usurper

Hello everyone, it’s been a long time since you’ve heard from me.

Web Investigation Lab — CyberDefenders Write-Up for Web Investigation Lab from CyberDefenders. Here we should figure it out how attacker using sqli to attack, gathering information and login into …

📡 “The System Is Talking… But Are We Listening?”

🚨The Night the Screens Went Silent

اللهم صل وسلم وبارك علي نبينا محمد

In decentralized finance, the order of operations is everything. A single asset transfer executed prior to fully writing internal state…

Difficulty: Hard (Community Rated)

Welcome to this new Medium post, today we’ll explore a technique to detect which functions inside ntdll.dll have been patched by an EDR or…

A bash tool for generating focused, context-aware password wordlists

After attending cybersecurity conferences, I like to take notes and share the talks that stood out to me. This one was by the speaker…

Your first line of defense isn’t a product — it’s a mindset.

CVSS 9.2. A heap buffer overflow sitting undetected since 2008. PoC published on GitHub. Now actively exploited in the wild. NGINX powers a…

In this write-up, I walk you through the Nmap Live Host Discovery room in TryHackMe. I explore how to use Nmap to discover live hosts using…