How Internet works & Windows OS & File System

A changelog widget’s HTML sanitizer strips every XSS vector you can name — and then hands you a full-page iframe on its own trusted domain…

A critical account-takeover bug on a European bike-share platform, a four-line forgery script, and the cruelest word in all of bug bounty…

A practical walkthrough of the most common JWT vulnerabilities, based on what I learned from PortSwigger’s Web Security Academy

JFrog warns of malicious npm packages that mimic PostCSS tooling, drop a Windows RAT, and target Chrome-stored passwords through a staged infection setup route.

Insufficient egress filtering is a commonly identified vulnerability found during BHIS penetration tests. The insufficient egress filtering finding indicates that network traffic leaving the organization’s environment is not properly restricted.

Learn how to identify and exploit web cache poisoning vulnerabilities using several different testing methods. Read the article now!

A couple of days ago, a good colleague of mine mentioned an OAuth flow that I hadn’t heard about. It was “Client- Initiated Back-Channel…

Description : A boot2root box that is modified from a box used in CuCTF by the team at Runcode.ninja

Writing after a very long time.

Watching the Watchers: Exploitation Vectors in Edge-Based Surveillance After a long hiatus from having ambivalence, I decided to return to writing. When I last published, I was deep in the weeds of …

Learn how to hack a vulnerable Windows machine using one of the most famous exploits in history — perfect for beginners getting into…

Challenge Summary

In today’s technology-driven world, Linux administration, automation, cloud computing, and containerization skills are among the most…

Researchers warn GhostShell is using fake drone documents to target Ukrainian defence teams, stealing passwords and sensitive data in a new cyber campaign.

Three days. That’s how long it took me to get Burp Suite seeing traffic from a Flutter app during a security assessment.

Finding Open Ports and Hidden Services

Overview

SQL Injection Analysis via Wireshark • Brute-Force Testing via Burp Suite