A strange web attack where the attacker doesn’t break the application. They convince the cache to store something it shouldn’t.

A practical VulnHub Mr. Robot walkthrough covering reconnaissanc,web enumeration,WordPress authentication,Linux privilege escalation

Redact PII, client infrastructure, credentials, and engagement identifiers before sharing penetration-testing evidence with public AI tools

Why a giant subdomain list means almost nothing until DNS, ports, TLS, and HTTP tell you what’s actually alive

For years, my bug bounty muscle memory looked the same: pick a web app, poke the API, look for the usual suspects — broken auth, XXS …

> 🧠 TL;DR — I found a reflected XSS in TechStore v1.0. One GET parameter, `id`, gets dropped straight into the page with no encoding and…

A walkthrough of a Web Cache Deception bug that turned a private profile API into a public one — and the story of how it got closed as a…

Riwayat aktivitas akun merupakan komponen kritis dalam arsitektur keamanan aplikasi modern. Fitur ini dirancang untuk memberikan…

I recently completed the OSAI certification, and for me, this was one of those certifications that immediately felt relevant to where…

Program name, domain, and a few other identifying details in this writeup have been redacted at my request — the rest is exactly how it…

There are vulnerabilities that require chaining multiple weaknesses, bypassing filters, and spending hours building an exploitation path.

¿Qué es el DNS?

Introducción

A breakdown of what I actually learned, built, and got wrong on the way to becoming SOC-ready — with the receipts to prove it.

Room Link: https://tryhackme.com/room/agentsudoctf

This is a walkthrough of the Malware-Traffic-Analysis.net exercise “Infection at the Japan Field Office” (2017–06–28). The exercise —…

Your review sits quietly in the database until an admin clicks the wrong filter

Introduction