Hi, I’m Hashem Ali Kahil , Orion7715

The phishing campaign that landed you domain user credentials with direct access into MS Office365 in 2019 gets your infrastructure burned…

https://tryhackme.com/room/foolsm8v2

So apparently losing once wasn’t enough for this room. It came back for round two.

What is LLMNR?

Exploiting Blind SQL Injection by Triggering Time Delays

From a Forgotten `htmlspecialchars()` to Full Admin Takeover The Story of CVE-2026–50740 let me tell you a story about how one missing function call a single forgotten `htmlspecialchars()` turned …

I read the published research on AI-generated code security instead of going off vibes. The vulnerability numbers are almost beside the…

When your Marriott Phoenix SPA report (#3642444) was closed on April 1, 2026, the application security community at large still treated…

After completing reconnaissance and scanning, I finally reach the phase that many people associate most with penetration testing —…

Magic is a medium difficulty HTB machine which involves SQL injection attack, arbitrary file upload and SUID binary exploitation.

Why replacing human cybersecurity professionals with AI is a fundamentally flawed idea, and what the future of the profession actually…

Task 1 — Introduction

Task 1 — Introduction

Step 1: Reconnaissance

“Skill is built on reps. These are your reps.”

Blaming triage is easy, taking ownership is not

Assalamualaikum everyone,

Dashlane just admitted attackers walked off with customer vaults. Whether yours becomes useful to them is decided by a master password and…

Dans cet article, je partage une expérimentation réalisée en laboratoire (Nethunter Pro) sur le comportement d’un point d’accès Wi-Fi lors…

A walkthrough of how on-prem Active Directory and Entra ID connect, and why the sync server is the crown jewel most defenders overlook.