I Already Knew the Job. I Didn’t Know the Tools

Internal penetration testing within a Microsoft Windows enterprise environment often begins with no credentials. When granted initial…

Authorization vulnerabilities are often overlooked because they don’t always involve complex exploits. Sometimes, a single…

Ever wondered how apps know who you are and what you’re allowed to do? Let’s break down token authentication from scratch — with real…

.اللهم انفعنا بما علَّمتنا، وعلِّمنا ما ينفعنا، وزِدنا علمًا وفقهًا وفهمًا يا رب العالمين

This was not one missed security check. It was a chain of four preventable failures.

This week, Supabase flagged several backend tables with: RLS Disabled in Public.

The challenge description mentions a flawed authentication logic between the Sender and Receiver services, which hints that both services…

Understanding conditions, jumps, and loops through an office maze with analytical malware defense prospective

The real scope starts where prompts meet private data, application permissions, and tools that can take action

Someone has already scanned every device connected to the internet. The results are searchable. Right now. And most engineers have no idea…

PyRat — TryHackMe WriteUp with Flags Date: 24/01/2026 Room Link: https://tryhackme.com/room/pyrat My Profile: https://tryhackme.com/p/RayenHafsawy 🧭 Introduction This lab chains Python code …

https://tryhackme.com/room/corridor

Enumeration

https://tryhackme.com/room/foolsmate

guest->thmuser->notadmin->svcadmin->SYSTEM

Tester Information

How Nmap commands work and how to use them

A practical, example-driven look at the #1 risk on the OWASP Top 10 IDOR, parameter tampering, and data leakage, with working examples and…

C00NN£CT!ON T€RM!N∀Ŧ€D

Introduction