A stored XSS in Meliodas HR platform, a €2,500 bounty, and the month that tested my patience

I promised this one a while back, right after the Tor internals post. Said the next one would be about actually accessing Tor safely…

Objective

TryHackMe: Disk Analysis & Autopsy

Phishing emails often rely on malicious links rather than malicious attachments. Attackers attempt to convince users to click a hyperlink…

Series: I’m working through all ten OWASP Top 10 vulnerability categories hands-on using Juice Shop and PortSwigger, and documenting each…

Practical Content Security Policy Bypass Techniques

A new series devoted to tech hacks explained by an actual hacker that you can use to set yourself apart from the woefully unprepared when…

Welcome to this write-up for the “File Hunter” task. In this post, we will explore the fundamentals of File Transfer Protocol (FTP) and…

TASK-2: THE EMAIL ADRESS

Detrás de cada inicio de sesión, pasarela de pago o consulta en una web, hay una base de datos haciendo el trabajo pesado. Almacena de…

How breaking out of a script tag led to a confirmed reflected XSS finding

An interactive guide for building your very own ethical hacking home lab using VMware

From directory brute-forcing to parameter mining, virtual host discovery and autocalibration—every flag explained with a working example…

Healthcare cybersecurity conversations often focus on compliance. Organizations ask whether they’ve completed their HIPAA risk assessment…

“Clocky” makinesi de bizi daha ilk saniyeden karşısına alıp “Zaman bir yanılsamadır.” diyor. Bu referans ile birlikte CTF’i tamamlayalım.

A simple-looking bonus challenge that turned into a great exercise in understanding HTTP requests, authentication, and application logic.

Footprinting a “Hard” HTB Box A walkthrough of chaining SNMP misconfigurations, IMAP mail access, and plaintext database credentials to fully compromise a Linux target. Footprinting labs are …

WordPress Security Advisory

Hi everyone, it’s been a while since my last article in 2022: A Deep dive into <iframe> src=”” attribute leading to a Stored XSS. I have…