A companion piece to “They Said Our Health Matters. My Privacy Didn’t.” This one is for the security crowd. No target, no identifiers, just…

Large Language Models have basically become the new intern on every cybersecurity team, fast, eager, surprisingly capable… and now and…

Overpass THM

TL;DR Walkthrough to the TryHackMe Ra practice VM, including a few things I didn’t see on the linked write-ups.

Two new Capture-the-Flag rooms, the Fools Mate and its sequel Fools Mate, Revenge.

Cybersecurity is a field where learning never stops. Every day brings new attack techniques, new defensive strategies, and new technologies…

Introduction 🔍

Responsible Disclosure: This vulnerability was responsibly disclosed, fixed by the vendor, and published only after receiving disclosure…

Responsible Disclosure Notice: The vulnerability described in this article was responsibly reported, verified, and remediated before…

📢 I have some exciting news: I’m launching a new series called the Secure Code Review Challenge. Check out the video version of this story…

Hola Comunidad.

The mistake the amateur do is they approaches reconnaissance like a linear process. Handed a /16 subnet or a wildcard domain, they load…

Platform: TryHackMe

Despite what some would lead you to believe, Crystal Kit is not, and was never intended to be, an all-encompassing nirvana of evasion tradecraft. It was a simple project to experiment with Crystal Palace (CPL) by applying evasion tradecraft to Cobalt Strike's…

How I Bypassed Mandatory 2FA Three Ways on One SaaS Platform (~$1,125) Redacted writeup. Program and target withheld per disclosure policy; endpoints and values below are illustrative. The platform …

Introduction

Found two P0 bugs in our own code last week. Here’s what that process looked like, what’s still not done, and why I think building AppSec…

The old defense of blocking known malicious domains is easily bypassed. Learn why — and the new strategies you need now.