It was 2 AM on a Saturday and I had been staring at the same open port for three hours.

Hey everyone! 👋 In this challenge, Flag Vault, we’ll analyze the target binary, uncover its hidden logic, and retrieve the flag using…

Introdução

Machine details

Objective

You do not need the 450 dollar Pro license to start earning.

Public reports are a free masterclass. Most people read them wrong.

Introduction

I was testing an e-commerce application last year. Nikto found nothing. Burp’s active scan came back clean. On paper, the app looked locked…

The simple logic behind CORS Misconfiguration, how I test for it, and why it is one of the easiest bugs to find

Part 3 of my SQL injection series. First I stole hidden data. Then I logged in as admin with no password. This time, I make the database…

The code was never random, and the seed was on your screen

Understanding Content Security Policy for XSS Testing

SOC Analyst | Offensive\Deffensive | Sysmon | ProcMon | Malware | MITRE ATT&CK

A meticulous guide to neutralizing bloatware, silencing telemetry, and configuring a hyper-efficient environment without breaking system…

  TL;DR A serious libssh2 vulnerability now puts SSH clients at risk. Researchers track it as CVE-2026-55200, with a CVSS 4.0 score of 9.2. A remote attacker can corrupt memory and run code o…

Three critical MariaDB server vulnerabilities, including a CVSS 10 flaw, allow attackers to execute shell commands. Patch your database servers immediately.

Mitel patched 12 critical MiCollab vulnerabilities, several at CVSS 10.0. Unauthenticated command injection and SQL injection flaws need urgent updates.

ESET found vendor-signed UEFI applications vulnerable to a Secure Boot bypass. Attackers can run pre-boot code. Update firmware and the UEFI DBX now.

Two critical HAProxy vulnerabilities threaten reverse-proxy security. These flaws allow denial of service and smuggling attacks. Patch servers immediately.

What are CSRFs ?