AI can write code in seconds. But shipping secure code still requires engineering judgment.

A beginner-friendly guide to understanding authentication vulnerabilities through simple explanations and real examples.

#Linux #HTBWalkthrough #HTBNexus #FileUpload #Gitea #Gobuster #fuff #subdomainEnumeration #GitPathTraversal #GitObjects

.اللهم انفعنا بما علَّمتنا، وعلِّمنا ما ينفعنا، وزِدنا علمًا وفقهًا وفهمًا يا رب العالمين

Hello World! During a recent security assessment, I came across an interesting finding in an AI-powered application that used a…

Cursor and HackerOne closed it as “informative, out of scope.” Seven months later, still no patch. So is it even a bug?

Before jumping into hashes and tools — why should you spend time on this?

In today’s Security Sunday, in addition to WordPress, we will look at EY, which reports a leak of client tax data, Microsoft fixed a record…

Network Components — Building Blocks of a Network

Attacks Become Faster

When I first started learning ethical hacking, I spent most of my time exploring tools like Nmap, Burp Suite, and Gobuster.

I Already Knew the Job. I Didn’t Know the Tools

Internal penetration testing within a Microsoft Windows enterprise environment often begins with no credentials. When granted initial…

Authorization vulnerabilities are often overlooked because they don’t always involve complex exploits. Sometimes, a single…

Ever wondered how apps know who you are and what you’re allowed to do? Let’s break down token authentication from scratch — with real…

.اللهم انفعنا بما علَّمتنا، وعلِّمنا ما ينفعنا، وزِدنا علمًا وفقهًا وفهمًا يا رب العالمين

This was not one missed security check. It was a chain of four preventable failures.

This week, Supabase flagged several backend tables with: RLS Disabled in Public.

The challenge description mentions a flawed authentication logic between the Sender and Receiver services, which hints that both services…

Understanding conditions, jumps, and loops through an office maze with analytical malware defense prospective

The real scope starts where prompts meet private data, application permissions, and tools that can take action