TASK 2: Room 404

OpenAI recently commenced pilot testing for a novel “Sign in with ChatGPT” authentication feature across select partner platforms. Similar to Google’s ubiquitous single sign-on m…

Part 5 of the Aii-Aii Hunter series: scope setup through a delivered finding, walked through on one example engagement

Another day another CTF challenge

The Website Wasn’t the Secret. The Repository Behind It Was.

Welcome to my next walk-through.

Understanding how an unauthenticated AWS Cognito Identity Pool can expose sensitive DynamoDB data.

Understanding Deception Technology Through a Simple Gaming Strategy

When many people start learning cybersecurity, they have one goal in mind: “I want to hack something.” I had the same mindset when I…

## Challenge: User-provided data is rendered in HTML templates without proper encoding, allowing JavaScript injection attacks. What…

Build systems rarely capture public attention; however, unauthorized access opens a direct pathway to source code, credentials, and compiled software. Amid this serious threat, JetBrains released …

At a glance Actor Unnamed operator; ReliaQuest notes tradecraft similar to APT28 (Fancy Bear, Forest Blizzard) but does not attribute the campaign Activity type Gateway compromise, DNS poisoning, …

At a glance Field Detail Actor / group BlueNoroff (TA444), a subgroup of North Korea’s Lazarus Group Activity type ClickFix phishing kit faking Zoom and Teams meetings Targets Web3 and crypt…

How did it get its name?

A walkthrough of an authorization gap in NotebookLM’s Gemini import flow, and an argument for why locking out an owner is a different class…

If you are just throwing standard tools at a target and walking away, you are leaving thousands of dollars on the table. Modern bug bounty…

This Is Our Reality

The digital underworld does not trade in software; it trades in trust, anonymity, and raw leverage. This is the enhanced, high-tension…

Introduction