“Map? Where we are going, we don’t need maps.” — Room tagline

This Position mate in A8 one move

For a student whose ambition was to become a doctor, she worked literally 24 hours a day to achieve her dream and finally ended up in the…

I highly recommend this room from TryHackMe as it teaches you basic SOC investigation skills and how to sift through event logs and find…

Introduction

We begin with a very simple piece of information. You have stumbled upon a Battered letter. Since everyone else has given up on the letter…

“Misconfigs conquered, identities claimed.”

My First VulnHub Walkthrough

Machine details

“Everyone remembers the moment the terminal stopped being scary.”

A no-nonsense space for bug hunters, web pentesters, CTF players & security researchers who are done learning alone.

Yesterday was all about XSS. Today, I spent most of my time diving into IDOR (Insecure Direct Object References) and Broken Access Control…

Most bug hunters open Burp. I open a terminal. Here’s why.

“The database trusted the input. That was its first mistake.”

Target: silentium.htbDifficulty: Medium/Hard Path: Auth bypass on staging API → Flowise admin takeover → CustomMCP RCE → Docker container…

By Odai Mherat

Cybersecurity is no longer a niche field reserved for large technology companies. As businesses, banks, healthcare providers, and…

The Faster Alternative Many Developers Overlook

DOM XSS Happens when a js takes the attacker input as passes it into a function without proper sanitization.

What Is Boss Scam? The New Cyber Fraud Trick That Can Cost Companies Millions Imagine receiving a message from your CEO asking you to transfer money immediately because a business deal has just been …

The admin button is hidden, but the API never asked who you were