How a simple callback_url parameter led to full account compromise

Disclaimer: This article describes a vulnerability that has already been responsibly disclosed and remediated. All identifying information…

Getting into a system is the easy part of the story. Every hacking movie ends right there — the green text scrolls, the screen flashes…

Understanding EAX, ESP, and EIP through a simple office story — no math, no fear.

Windows has exactly one cryptographic mechanism for verifying a PE file is trustworthy. It’s optional, enforced only in specific contexts…

Task 1 Introduction:

Reversing ELF is a room for beginner Reverse Engineering CTF players. The room contains 8 very basic challenges which will introduce us to…

Introduction

You reviewed your payment API code. Your unit tests passed, your vulnerability scans are clean, and your API gateway security policies are…

How a piece of code the size of a photo file infiltrated one of the most guarded facilities on Earth — and rewrote the rules of war

A transparent case study on why understanding disclosure pipelines is just as critical as finding the vulnerability itself.

Welcome to this new Medium post, today we are looking at the ETW session hijacking technique, redirecting the trace output to Blind…

Esse artigo é um write-up do desafio pwn106 da TryHackMe. Esse desafio faz parte da sala PWN101 de exploração de binários. O link da sala é…

In this walkthrough, I’ll be solving the “Operation Coldstart” room on TryHackMe.

Introduciton:

TL;DR Walkthrough of the TryHackMe rooms Walking An Application and Content Discovery. Both rooms use the same webapp so I’m simply doing a…

┌─[ THM :: Brr ] ──────────────────────────────
│ category : ICS / OT · Modbus TCP
│ surface : ScadaBR (HMI) ─▶ Modbus slave (plc)
│ path …

Learn more about SOC alerts and build a systematic approach to efficiently triaging them.

From credential exposure in HTML comments to root via kernel exploit (CVE-2021–3493)

Definition

Cyber Threat Sweeps Asia in 2026 The Year the Attackers Stopped Knocking There is a particular kind of silence that security teams have learned to fear. It is not the silence of a quiet network. It …