This is my writeup for Hidden in Plainsight, an Easy-rated Forensics challenge on PicoCTF.

🔍 Opening the Challenge

1. Introduction

Switch to QUERY http method Secure coding should always be the top priority for developers while building applications. Hence it was a welcome news when the HTTP QUERY Method was formally introduced …

Abstract

SSH is not merely a remote-login command. In the hands of a system administrator, developer, penetration tester, or ethical hacker, it…

Using an ESP32 Marauder Without a Screen: A Phone and Desktop Controller Over USB

Hello and welcome to my first write-up, I am d4nc00p3r and I am a new pentester learning by myself.

Introduction

Enumeration

During a security assessment of a web app, I discovered a critical authentication bypass that allowed account takeover of arbitrary users.

Hello everyone! My name is Arfat Khan, and I run a YouTube channel called Arfi Tutorials. I am a bug bounty hunter, penetration tester, and…

Quite interesting room that challenges your basic reconnaissance abilities. At first i tried simply do checkmate and got embarrassing…

Triage alerts, reassemble streams, extract files, and detect protocol abuse via Wireshark & TShark.

If you’re asking about API security for a Runway-based application (or any application codenamed “Runway”), the key principle is that API…

The place the bugs live is already open in your browser. Most hunters spend hours looking everywhere else.

After an initial nmap scan, only two services were exposed:

Hello, Nascent Hackers!

He wasn’t a professional hacker. He wasn’t working for a government. He was just 15 years old.

A source-to-sink analysis of CVE-2026–49987 in Repomix — and how a single missing delimiter bypassed built-in security controls and leads…

hi guys, aryan here!