If you’ve read any of my writing here, thank you — it means a lot.

Web Application Firewalls have been built around the same idea for decades: inspect the request, match it against known attack patterns…

One of the fundamental principles of API security is ensuring that applications expose only the information that users genuinely need.

Rethinking API Security Through Behavioral Intelligence, Anomaly Detection, and AI-Powered Reasoning

In the world of bug bounty hunting, we often talk about complex exploit chains or fancy RCEs. But sometimes, the most dangerous…

From Detection to Exploitation — Breaking Modern Web Application Firewalls

A step-by-step walkthrough of a Reflected XSS discovery, from an unusual URL to an independent security advisory.

In the previous part we made a lab with vulnerabilities that, at least to me, is one of the coolest. Today we’re building a lab that can be…

In 1998, a researcher named Jeff Forristal published a paper showing that you could manipulate a website’s database just by typing the…

A hostname allowlist helps at input time. The real attack starts after your server sends the request.

When the web application fetches things on your behalf — and you realize you can control what it fetches. Part 1 of the SSRF series.

漏洞摘要 該漏洞在 2026 年 5 月底揭露，根據 cybersecuritynews 報導，該漏洞是因為在 Notepad++ 在 v8.9.6（含）以前的版本中，存在設定檔解析缺乏輸入驗證的命令執行漏洞，由於標準安裝版會去讀取…

Gaadi Info helps you check vehicle owner details, RC status, driving licence information, challan status, insurance details, and RTO…

Hello Friend,

SQL Firewall in Oracle Database 26ai is come with database security feature. it can protect the database from any unauthorized SQL…

Siber güvenlik süreçlerinde karşılaştığımız zafiyetleri sadece otomatize araçlarla taratıp geçmek, bizi iyi bir mühendis yapmaz. İşin…

Most pentesters or OffSec students are familiarized with inbound SQLi. Those are the kind of injections that give the user some text back…

A ukey token in a forgot-password email handed me full read access to every record in their database. Reported in early 2025. Still live.

Máquina Premium de la plataforma TryHackMe que permite explotar vulnerabilidades LFI y SQL Injection…

Recruit has just launched its new recruitment portal, allowing HR staff to manage candidate applications and administrators to oversee…

One SQL Injection. 2,000+ Victims. The Biggest Mass-Hack in Recent History.