I took part in a practical ethical hacking exercise using the Metasploit Framework and its Meterpreter payload. Rather than just describing…

Building Your First Ethical Hacking Lab and Understanding Network Scanning

Cookies are one of the most fundamental building blocks of the modern web, and yet they are often overlooked from a security perspective. When misconfigured, they can potentially lead to exposure of s...

When there’s no file to read and no time delay to measure: proving Remote Code Execution using Burp Collaborator and DNS callbacks.

Description : Face a server that feels as if it was configured and deployed by Satan himself. Can you escalate to root?

Solution:

Why People Seek Professional Cybersecurity Assistance (like [email protected])

Solution:

The first clue looked convincing.

What a broken deployment, an unauthenticated SAP endpoint, and a footnote taught me about what assessment delivery actually requires.

Why trusting the Host header can quietly break your website’s security

Part 2 of my CICD-Goat pentest: indirect pipeline execution, credentials inherited by a Makefile, and a PyPI token recovered from Git…

Date: 27/06/2026

(A Beginner’s Guide to Searching Logs with Splunk)

Most engineering teams focus on access token expiry. The credential that can silently own your users’ accounts for 30 days is quietly…

Free account → full data breach → 1,630 private documents → CEO account takeover. All before my coffee got cold.

One click, eight seconds, nine webhook hits. It started with a single bracket character that broke an Akamai WAF rule.

The grand finale: smuggling command output inside a DNS query to steal data from a completely silent, fully blind vulnerability.