Master the pattern-hunting tool that developers, system administrators, and security analysts use to find the signal buried inside the…

สรุปเคสช่องโหว่ลักไก่: แกะรอย Session Replay เจาะทะลุ 2FA จากคุกกี้ไร้เงา HttpOnly

On July 28, 2026, the CVE™ Program launched the “Frontier AI Researcher CVE Numbering Authorities (CNAs) Pilot,” an initial six-month…

Introduction

Inside the Open Source Platform That Turns Autonomous AI Teams Into Real Penetration Testers

The Room 404 is the Day 2 challenge of TryHackMe’s Hacker Holidays, where we were presented with a web application running on port 8080.

What happens when the attacker isn’t a stranger on the internet but a colleague who already knows where the sensitive files live?

Byte Lotus — Source Code Disclosure via Exposed Git Repository

One of the most overlooked web application misconfigurations is exposing the .git directory over HTTP.

You can play this room for free: “https://tryhackme.com/room/hh-room404-804573bf”

Hello, red teamers!

I expected to search for a username, find a few social media accounts, answer the questions, and move on.

There’s a class of vulnerability that doesn’t get enough attention in the bug bounty community. It’s not a SQL injection. It’s not a…

Most hunters test authentication. Almost nobody tests authorization at the role level.

GhostWriter demuestra que un asistente con memoria persistente puede conservar algo más que contexto útil: también puede recordar…

Introduction

TryHackMe Room Link

Este writeup documenta o processo passo a passo para comprometer um servidor alvo. Além de mostrar quais comandos foram executados, o…

Concierge Briefing

Understand how SQL injection attacks work and how to exploit this vulnerability.

Concierge Briefing