A Medium Linux box that teaches why client-side authentication, unauthenticated caches, and docker group membership are a recipe for full…

This lab shows a vulnerability in a GraphQL implementation where users can access sensitive fields because the queries are not properly…

Introduction

Introduction

I am still writing it so I will update this later. For now please check out my other writeups!! Thank you!!

If someone had told me a few years ago that I’d be learning Python, analyzing datasets, and interviewing for Business Intelligence Analyst…

Introduction

Researchers say FortiBleed used stolen and tested credentials to access exposed Fortinet firewalls, putting major organizations and public agencies at risk now.

A critical Apache Shiro LDAP Injection vulnerability in DefaultLdapRealm, CVE-2026-49268, allows authentication bypass. Update your framework immediately.

We did it manually. Now let’s see what happens when you hand it to a tool. Last part of the SSTI series.

Target: gitlab.smce.nasa.gov Program: NASA VDP (Bugcrowd) Severity: P3 — Broken Access Control / IDOR Status: Resolved

The Ultimate Account Takeover One-Two Punch

Jinja2 was Python. Twig is PHP. The vulnerability is the same — the path looks completely different. Part 3 of the SSTI series.

The CVE™ Program’s “Supplier CVE Numbering Authority (CNA) as Authorized Data Publisher Pilot (SADP Pilot)” has been up and running in…

A beginner-friendly penetration testing walkthrough of the DC-1 boot2root machine

When people think about penetration testing, they often imagine sophisticated exploits and advanced malware. In reality, many compromises…

Author’s Note: Back in 2013, I wrote one of my earliest technical articles on CodeProject — a step-by-step guide to integrating Twitter API…

Bookstore Category: Web / RCE Difficulty: Hard