As per OWASP Top 10 2025, injection is ranked top 5 categorizing the likes of SQL injection and command injection.

Access control is the most boring topic in tech, right up until one bad setting leaks thousands of people’s private data. AWS S3 makes…

When we talk about hunting for Remote Code Execution (RCE), we usually look at the file upload components or the main input fields of an…

Hello Hackers 👋

Introduction In application security, the most critical vulnerabilities often reside in business logic — flaws that automated scanners…

Technical analysis of a logical lock screen bypass I discovered in Google Gemini and reported via Google VRP.

الحمد لله الذي عَلَّمَ بالقلم، عَلَّمَ الإنسانَ ما لم يعلم، والصلاة والسلام على سيدنا محمد ﷺ

Learn how AI startups use global hiring, EOR partners, and remote systems to access talent, stay compliant, and extend runway efficiently for sustainable growth.

This is what I did after my lunch break and immediately got enough cash to buy stuff in the premium store

Introduction

Automating Reconnaissance for Faster and More Efficient Security Assessments

A practical primer on one of the most common — and most underestimated — classes of web vulnerability, plus the current toolkit security…

Description : Fall down the rabbit hole and enter wonderland.

Solution:

The dashboard looked perfect.

A Beginner friendly Guide to solving the Bugged Room on TryHackMe

When a simple shortcode becomes a persistent script injection vector

# Account Deletion — Password Confirmation Bypass

A working methodology for finding bugs and writing exploits in browsers, hypervisors, and other hardened software, plus why the same system…

Recently, I identified and successfully validated an **XML External Entity (XXE)** vulnerability caused by an insecure XML parser…