Siber güvenlik süreçlerinde karşılaştığımız zafiyetleri sadece otomatize araçlarla taratıp geçmek, bizi iyi bir mühendis yapmaz. İşin…

Most pentesters or OffSec students are familiarized with inbound SQLi. Those are the kind of injections that give the user some text back…

A ukey token in a forgot-password email handed me full read access to every record in their database. Reported in early 2025. Still live.

Máquina Premium de la plataforma TryHackMe que permite explotar vulnerabilidades LFI y SQL Injection…

Recruit has just launched its new recruitment portal, allowing HR staff to manage candidate applications and administrators to oversee…

One SQL Injection. 2,000+ Victims. The Biggest Mass-Hack in Recent History.

Today , we are going to investigate the SOC127 alert in LetsDefend.

I have been hunting for a while on the Hackerone public program and what I learned is If you choose the right program and spend more time…

Allows users who are not members of a group to add any group to their favorites on their Facebook profile.

https://gitlab.com/gitlab-org/gitlab/-/work_items/551267

These Low-Hanging Fruits Made Me $120+ in 30 Minutes — Bugs That 80% of Hunters Ignore Hi everyone , bhavish here When people think about bug bounty, they imagine critical RCEs, SQL injections, and …

A bug bounty story about OAuth, PKCE, open client registration, and how multiple low-level issues chained together into a critical account…

No complex setups. No secret tools. Just you and your browser.

Hello Raccoonians,

Hello Everyone,

“سُبْحَانَكَ لا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا إِنَّكَ أَنْتَ الْعَلِيمُ الْحَكِيمُ”

Platform: BugForge
Category: Broken Access Control / Mass Assignment

Here’s what I was doing wrong and how I fixed it.

30 Years in Bug Hunting and I’ve Had Enough of the Scams 😤🔥

It’s not skill. It’s not luck. Here’s the actual difference.

“No methodology. No fancy tools. Just a meme, a hunch, and a chatbot that really should have stayed in its lane.”