Introduction

“Read web app source like an attacker: trace user input to dangerous sinks, triage with Semgrep.”

Learning web security is not just about finding vulnerabilities — it’s about understanding why they exist and how developers can prevent…

What’s up, hackers? Sumit here, aka hacksage 😌

TL;DR A high-severity decompress npm vulnerability lets crafted archives write files outside the extraction folder. Tracked as CVE-2026-53486, the flaw carries a CVSS score of 9.1. It sits in a li…

Web applications often display content from external sources to improve functionality or user experience. One common way to do this is by…

Hi everyone 👏

Hello, I am Root. If you don’t know me, that’s fine, because someday you will. And Ah… where were we? Never mind, I just zoned out.

Hello Guys back with another token stealing exploit lets start with some basics:

This TryHackMe room focuses on Server-Side Template Injection (SSTI), a web application vulnerability that occurs when user-supplied input…

A beginner-level windows CTF challenge.

Meet DeceptiTech

You type google.com and hit Enter. In milliseconds, your request travels across the globe and comes back with a webpage. But how? And who’s…

Learn how to solve the SSTI2 challenge by identifying a Server-Side Template Injection (SSTI) vulnerability, understanding why…

A Complete Guide for Security Researchers

When investigating a cybersecurity incident, analysts rely on evidence rather than assumptions. One of the most valuable sources of that…

How a simple callback_url parameter led to full account compromise

Disclaimer: This article describes a vulnerability that has already been responsibly disclosed and remediated. All identifying information…

Getting into a system is the easy part of the story. Every hacking movie ends right there — the green text scrolls, the screen flashes…

Understanding EAX, ESP, and EIP through a simple office story — no math, no fear.