TL;DR Walkthrough to the TryHackMe Ra practice VM, including a few things I didn’t see on the linked write-ups.

Two new Capture-the-Flag rooms, the Fools Mate and its sequel Fools Mate, Revenge.

Cybersecurity is a field where learning never stops. Every day brings new attack techniques, new defensive strategies, and new technologies…

Introduction 🔍

Responsible Disclosure: This vulnerability was responsibly disclosed, fixed by the vendor, and published only after receiving disclosure…

Responsible Disclosure Notice: The vulnerability described in this article was responsibly reported, verified, and remediated before…

📢 I have some exciting news: I’m launching a new series called the Secure Code Review Challenge. Check out the video version of this story…

Hola Comunidad.

The mistake the amateur do is they approaches reconnaissance like a linear process. Handed a /16 subnet or a wildcard domain, they load…

Platform: TryHackMe

Despite what some would lead you to believe, Crystal Kit is not, and was never intended to be, an all-encompassing nirvana of evasion tradecraft. It was a simple project to experiment with Crystal Palace (CPL) by applying evasion tradecraft to Cobalt Strike's…

How I Bypassed Mandatory 2FA Three Ways on One SaaS Platform (~$1,125) Redacted writeup. Program and target withheld per disclosure policy; endpoints and values below are illustrative. The platform …

Introduction

Found two P0 bugs in our own code last week. Here’s what that process looked like, what’s still not done, and why I think building AppSec…

The old defense of blocking known malicious domains is easily bypassed. Learn why — and the new strategies you need now.

Every command you run against a cluster goes through one door: the API server. So the first real question in Kubernetes security isn’t “how…

Spanish police and the FBI arrested an alleged Cyber Army of Russia Reborn member as international efforts against pro Russia cyberattacks continue worldwide.

In 2024, 83% of organizations suffered an API security incident. Attackers are no longer kicking down the front door — they’re sliding…

The modern internet isn’t run by omniscient gods. It’s run by overworked sysadmins, bloated enterprise suites, and automated scrapers…