A Single Key to the Kingdom Granting edit permissions to a single chatbot proved to be the master key to an entire system. Specifically, the Rogue Agent vulnerability discovered within Google Dial…

Hundreds of WordPress sites remain easy targets year after year. The cause is rarely a rare zero-day vulnerability. Instead, it is outdated PHP versions, forgotten plugins, and default configurati…

TL;DR Researchers have published full details and proof-of-concept code for GhostLock. This Linux kernel bug, tracked as CVE-2026-43499, hid in the code for over 15 years. It lets an unprivileged …

Host Header Injection → Open Redirect

A weekend OSINT experiment that turned into a lesson about how much of our lives are quietly indexable.

Description: This lab contains a DOM-based cross-site scripting vulnerability on the home page. It uses jQuery’s $() selector function to…

There’s a special kind of dread reserved for the question “who owns this service account.” Nobody does, is usually the honest answer. It…

Responsible Disclosure: This issue was responsibly disclosed to the vendor, remediated, and published only after receiving permission for…

How I Pioneered The AOL InstaKiss Scam

A walkthrough covering libssh authentication bypass, post-exploitation enumeration across system files, and /etc/shadow manipulation for…

If you solved the previous Fools Mate challenge, you probably remember that the real challenge wasn’t playing chess.

*DISCLAIMER : Everything I’ve discussed here has been fixed and reported directly to the owner, and I also received a certificate of…

The open-source operating system Ubuntu typically releases Long Term Support (LTS) and non-LTS versions at regular intervals. LTS releases offer at least five years of security updates. Moreover, …

The Biden administration originally instituted the Broadband Consumer Labels directive. They designed this framework to help citizens decipher their internet bills flawlessly. However, this commen…

Malware family PureLog Stealer (delivered by the Veil#Drop framework) Threat actor Not attributed by Securonix Targets Windows users; victim count not disclosed Delivery vector Malicious JavaScrip…

introduction

Introduction

Today we will pwn Orion from HackTheBox. It’s an easy-difficulty Linux machine by Pho3o.

You download Kali Linux. Spin it up in VMware. Hit start.