The platform coordinating security for 16 host cities, 3 million fans, and the largest sporting event in North American history was…

Most social engineering has a tell. A domain that is one character off. A sender you have never heard from. A tone that does not match the…

What Lahaina and the Palisades should teach anyone who tests systems for a living

Note: This write-up is based on the steps I actually performed while solving the room. I kept the explanations simple so that someone…

A beginner-friendly walkthrough of how identity spoofing against a poorly-guarded AI assistant led to an internal secret it was told never…

Room: The Hollow Shell Category: Web Difficulty: Medium Platform: TryHackMe

Room: CryptoCabana Category: Cloud Difficulty: Medium

A modern SOC can generate millions of security events every day.

Server-Side Template Injection (SSTI) occurs when user-controlled input is processed by a server-side template engine as template code…

Publicly Exposed Prometheus Metrics & Debug Information in a Telekom IoT API

The “Infinite Money” Glitch

On July 11, 2026, at 22:13 UTC, an attacker began draining liquidity pools on BlueMove DEX, a Sui-based AMM. Within 23 minutes…

Metasploitable 1: Be a Telnet Master

PicoCTF — Investigative Reversing 0 & Investigative Reversing 1

How combining episodic meta learning with Mahalanobis distance let a network classify attacks from a handful of examples and flag ones it…

CISA Confirms: SonicWall SMA1000 Vulnerabilities Are Now Being Exploited to Deploy Ransomware

JWTs (Json Web Tokens) is basically a digital token that allows a server to identify an authenticated user without asking for the username…

https://tryhackme.com/room/hh-towelonthesunbed-61271709

Testing the YAML Import Function

A beginner-friendly walkthrough of how directory enumeration exposed source code, Git history, and a secret left behind in an old commit.