While testing target.com, I came across an interesting business-logic issue in the company management functionality.

This is a reflected XSS where unsanitized input is injected into the HTML and executed by the browser. The script runs only when a victim…

The films that set the language the industry still uses when it talks to the public about hacking.

We are supposed to buy the Lightweight l33t leather jacket and as per the lab name, I think this has to do with bypassing client side…

Comparing Files with Diff

Descargar software desde una plataforma reconocida suele percibirse como una decisión segura. La aplicación aparece en un catálogo formal…

Most tabletop exercises are theater — a scripted walk through a scenario everyone knew the answers to, ending with a slide that says “we’re…

🚨 GhostDesk: The Spyware Hiding Inside Fake CCleaner Installers

1. Introduction

A practical guide to building an isolated cybersecurity lab using VirtualBox, Kali Linux, Metasploitable 2, Nmap, and Host-Only networking.

Introduction

A Practical Walkthrough from Nmap Enumeration to Linux Privilege Escalation

TryHackMe Easy Peasy — Commands, Output and How I Found Every Answer

Learn what the Pyramid of Pain is and how it ranks indicators by how painful they are for an adversary to change.

Introduction

Lab Information

Bounty Case Files #02 | How a Broken Function-Level Authorization vulnerability allowed a free-tier user to enumerate and execute internal…

Welcome to this new Medium post, in this one we will see how to enumerate and unlink thread creation callbacks registered through…

Attacking Google Cloud — Part 2 / 7

You type `smtp_server: 10.0.0.5` into a text field.

Executive Summary