Machine link: https://app.hackthebox.com/machines/Authority

Introduction

I still remember the first time I saw:

In the world of security analysis, it’s easy to get carried away with the automated alerts of a SIEM. However, the analyst’s real work…

JWTs are trusted by millions of APIs worldwide: yet one small misconfiguration can turn a security feature into an attacker’s gateway

Hey everyone! 👋

A weird reload, a log.io dashboard, plaintext passwords, and no tidy explanation. But I have a few theories.

The cheapest, most effective first move when you crack open any embedded device

The numbers are staggering, the tactics are evolving, and 2026 is shaping up to be a record-breaking year.

Description : Learn the basics of host-server configuration reviews.

Unlike web apps, SCADA misconfigurations are not edge cases. They are the norm. This is a story about following a chain of them to its end…

Chaining API weaknesses to gain deeper access and expose data

Understand CSRF vulnerability and practice exploiting insecure state-changing requests.

Discover hidden web content using manual techniques, OSINT, and Gobuster enumeration.

Introduction: The Engineering Paradigm of “Building” in Cybersecurity Research

One thing enjoy throughout my cybersecurity learning journey is discovering how closely security and QA overlap.

Unauthorised KeyManager modification via Java reflection bypass — enabling cryptographic registry tampering inside Google’s ecosystem

The complete beginner-friendly guide — what IDOR is, where to find it, and how to test it step by step

In a single stretch this spring, the AI and crypto world ran up an expensive lesson, and almost none of it needed a human at the keyboard…

The Tuesday Everything Stopped: How Ten Cyberattacks Rewrote the Rules of Modern Conflict