Phase 1: Initial Mapping & Baseline Reconnaissance

A hands-on writeup on discovering and exploiting a prototype pollution flaw in an Express.js

Introduction

بِسْمِ اللَّهِ الرَّحْمَنِ الرَّحِيــــــمِ

Artificial Intelligence is rapidly changing the cybersecurity landscape. While traditional penetration testing tools remain essential, AI…

Bounty Case Files #01 How multiple trust-boundary failures allowed anonymous access to premium functionality in a production API

Discovering a blind SQL injection, gaining access to the administrator panel, and escalating privileges to root.

One vulnerability class. Three decades of history. And now, the exact thing exposing thousands of AI agent servers to the open internet.

Continue topic EDR

Executive Summary

Executive Summary

In May 2017 people across the UK started their Monday morning shift at NHS hospitals and found something terrifying. Their computers were…

If you have spent most of your life using Windows, switching to Linux can feel like learning how to use a computer all over again.

Introduction

What one removed feature reveals about confusing low adoption with low value.

Task 4: Vulnerable Startup — Broken Authentication and Task 5: Vulnerable Startup — Broken Authentication 2. These tasks demonstrate how…

The MCP Bug Bounty Field Guide · Part 1 of 5 — what the protocol is, and why it just created the most under-hunted surface of 2026.

Microsoft’s July 2026 Patch Tuesday fixes 622 CVEs, including exploited AD FS and SharePoint flaws, plus the disclosed BitLocker bypass requiring urgent action.