In this blog, I’ll walk through how the STUN protocol and WebRTC can expose a caller’s real IP address during a WhatsApp call, and how I…

Hammer(THM) — Rate Limits JWT Forgery A web exploitation writeup covering directory fuzzing, password-reset brute forcing, rate-limit bypass via IP spoofing, command injection, and JWT key …

Four TryHackMe rooms in one sitting. A hashing OSINT trail, a FUEL CMS remote code execution, and two AI concierges that talked when they…

A practical walkthrough of enumeration, hidden directories, encoding, hash cracking, steganography, SSH and Linux privilege escalation.

A breakdown of the SAL1 exam, its SOC scenarios, tools, and how to prepare effectively using TryHackMe

Modern web apps aren’t just “pages in a browser” — they’re interactive systems where the client (browser) and the server continuously…

It is mainly used for DNS troubleshooting, network analysis, and information gathering during reconnaissance.

Challenge Description

A single access-control mistake across multiple sharing APIs turned into three accepted reports – and three payouts.

Google can index far more than publicly intended webpages. During an authorized bug bounty assessment, search operators can help…

SQLi is decades old and still one of the highest-paying bug classes in 2026 — here’s the exact recon-to-report process that actually finds…

I finally got my first bug bounty.

Hello everyone,

Beyond the ‘Privateer’ Buzzword

Platform: TryHackMe Room: Mr. Robot Difficulty: Medium Goal: Find 3 flags (keys)

If you’re building a modern application, you’ve probably come across both API gateways and load balancers.

Alternative title: The Hidden Cybercrime Economy Behind Expired Domains

Everyone's searching CVE-2026-50522, Here's the step-by-step IDOR method beginners actually use to find paid bugs, by b0dj0x.

One APK, six challenges, and a chain that ends in someone else’s S3 bucket. Here’s every solve, from strings to SSRF.

The setup