Voucher Vault: Exploiting UNION-Based SQL Injection to Extract Hidden Admin Data

What began as a handful of missing Windows Defender alerts quickly unfolded into a deliberate defense evasion campaign designed to blind…

The Signal Protocol works. Everything built around it is where things get complicated.

The SonicWall patch worked. The firmware updated. The security report showed green. And then hackers walked straight through your front…

Large language models are increasingly being embedded into:

I’ll be covering the answers and walkthrough for this room. So buckle up and let’s dive in.

CTF Writeups Export

The previous blog was something that some of you really liked, I did say it was a series so reason enough to do a part two. In this blog…

FBI warns of Kali365, a PaaS scam kit that lets cybercriminals bypass MFA and hijack Microsoft 365 accounts without passwords.

1. RECONNAISSANCE/FOOTPRINTING

OverTheWire Bandit Walkthrough — Level 10 → 11 | 30-Day Cybersecurity Learning Journey (Day 11) Decoding base64 encoded data from the command line and why recognising and reversing encoding …

MagnusBilling RCE (CVE-2023–30258) + Fail2ban Privesc

TryHackMe privilege escalation walkthrough using process monitoring and PATH hijacking on Linux

أغرب حاجة في مجال الباونتي إنك ممكن تتعلم 6 شهور

After my previous IDOR report team pushed the fix and closed report as resolved. Always after the fix is pushed for my reported issues, I…

Platform: BugForge
Category: Insecure Direct Object Reference (IDOR)

I ran Nmap scans and captured everything in Wireshark simultaneously. Here’s exactly what I discovered at byte level — not theory, real…

Medium-level challenge that required knowledge of SQL Injection, Basic LFI (Local File Inclusion), Web enumeration (gobuster)…

BOLA is OWASP’s number one API risk. Your authentication middleware does not stop it. Here is the code pattern that does.

Two real SQLi vulnerabilities found during bug hunting — both out of scope, both reported anyway

How to Find Low hanging fruits