Security vulnerabilities are not always created by bad code. Sometimes, the code is secure, the logic is correct, and the authentication is…

Overview

At IT security events and in professional discussions, I am currently seeing the following picture: More and more decision-makers at small…

Part 3 of my CICD-Goat pentest: overprivileged tokens, controller-node execution, fail-open security checks, and mutable Docker images

From anonymous FTP to root shell: privilege escalation in action

Every disk image tells a story. In this challenge, what started as a simple forensic investigation quickly turned into a hunt through…

The wrong first program quits more beginners than the difficulty does.

The Aogiri-Tree fintech bug that made me believe in timing attacks again

Easy to understand. Easy to spot. Pays well.

OpenAI just previewed GPT-5.6 Sol, and if you run a security program or build software for a living, you should pay attention to one line…

Imagine leaving your house unlocked while you’re on a week-long vacation. You wouldn’t do it, right? Yet, millions of us leave our personal…

Your firewall can pass every audit and still be compromised. Tens of thousands already are — and a lot of them are government.

A hands-on walkthrough of Docker, Kubernetes, Git, Binary, and AI secret leaks — and how to stop them in enterprise environments.

Understanding How Logs Reach Your SIEM

Protection (checksec)

“You talked a big game about being the most elite hacker in the solar system. Prove it and claim your right to the status of Elite Bounty Hacker!”

When dealing with a restrictive Web Application Firewall (WAF), a standard XSS payload like <script>alert(1)</script> or <img src=x…

Cross-Site Scripting (XSS) is always a fun challenge, but when a web application deploys a strict Web Application Firewall (WAF) or input…

You might have come across a reel or a post claiming that hackers can now replicate Google’s sign-in popups. At first, it sounds like…

DIY or Die

A Step-by-Step Guide to Bypassing Developer Options Through Code Tampering