The attack that worked on me didn’t use a single piece of technology.

“” is published by Aditya Singh (Elite Hacker 1337).

Bonjour was a clean machine that used a subtle information leak via mDNS (Bonjour) to provide SSH credentials, and then relied on a single…

In Part 1 of this series, we examined 12 web security vulnerabilities and weaknesses involving JWTs, Java configuration, TLS, HTTP request…

While the OWASP Top 10 serves as an industry benchmark for web security, restricting application security testing solely to OWASP risks…

Cloud penetration testing helps organizations find exploitable weaknesses in AWS, Microsoft Azure, Google Cloud, Kubernetes, serverless…

TryHackMe: Payloads — Walkthrough The Incident The incident directory contains four main components: deployment and network logs in logs/, the production model currently in use, a candidate …

Difficulty: Easy Category: Web Application Time Required: 40 min

Successfully managed to collect all tickets!

Introduction

Every day, we open dozens of apps without thinking about what happens behind the screen. You tap an icon, the app opens, and within a few…

How design, security, and monetization are redefining what an API is for

This is the walkthrough of portswigger lab: Blind SQL injection with time delays and information retrieval.

TL;DR Researchers published full details and a proof-of-concept tool for CVE-2026-27912, called ResetNightmare. The flaw sits in the Windows Kerberos Change Password protocol. It lets an attacker …

TL;DR SAP released its August 2026 Patch Day on August 11, with 28 new security notes. The headline flaw, CVE-2026-58231, scores a maximum CVSS 10.0. Several critical code injection bugs also enab…

Bug bounty hunting often involves repeating the same reconnaissance tasks across different targets: discovering subdomains, checking open…