I spent the last stretch of my bug bounty prep working through PortSwigger’s blind SQL injection labs, and I want to write down what I…

Platform: TryHackMe

Conti An Exchange server was compromised with ransomware. Use Splunk to investigate how the attackers compromised the server. Un beau jour, des employés ont remarqué qu’ils ne peuvent plus …

Title

Title: Complete Captcha Bypass on Publisher Registration Endpoint /webapi/auth/publisher leading to Mass Account Creation

Learn why Unity is still a trusted engine for mobile games, from faster prototyping and Android and iOS support to tools that help studios scale after releases.

The consumer infosec market is running a massive, multi-million dollar grift on your insecurity.

DISCLAIMER!!! FOR EDUCATIONAL PURPOSES ONLY!! Do not attempt without consent.

TL;DR The CISA KEV Catalog just gained four actively exploited flaws. Three of them carry a top CVSS score of 10. Federal agencies must patch all four by July 10, 2026. Why it matters CISA adds bu…

How to catch a cheating spouse: Discover If Your spouse is cheating without them knowing

Firmware extracting thrift store junk and finding private key The art of basic hardware hacking opens up countless avenues for exploration, from consumer routers to cutting-edge devices fresh off the …

Good afternoon folks. A few months back, one of the analysts on my team showed me something that made my week and ruined my afternoon…

TryHackMe Room Link

A Single Key to the Kingdom Granting edit permissions to a single chatbot proved to be the master key to an entire system. Specifically, the Rogue Agent vulnerability discovered within Google Dial…

Hundreds of WordPress sites remain easy targets year after year. The cause is rarely a rare zero-day vulnerability. Instead, it is outdated PHP versions, forgotten plugins, and default configurati…

TL;DR Researchers have published full details and proof-of-concept code for GhostLock. This Linux kernel bug, tracked as CVE-2026-43499, hid in the code for over 15 years. It lets an unprivileged …

Host Header Injection → Open Redirect

A weekend OSINT experiment that turned into a lesson about how much of our lives are quietly indexable.

Description: This lab contains a DOM-based cross-site scripting vulnerability on the home page. It uses jQuery’s $() selector function to…

There’s a special kind of dread reserved for the question “who owns this service account.” Nobody does, is usually the honest answer. It…

Responsible Disclosure: This issue was responsibly disclosed to the vendor, remediated, and published only after receiving permission for…