For years, my bug bounty muscle memory looked the same: pick a web app, poke the API, look for the usual suspects — broken auth, XXS …

> 🧠 TL;DR — I found a reflected XSS in TechStore v1.0. One GET parameter, `id`, gets dropped straight into the page with no encoding and…

A walkthrough of a Web Cache Deception bug that turned a private profile API into a public one — and the story of how it got closed as a…

Riwayat aktivitas akun merupakan komponen kritis dalam arsitektur keamanan aplikasi modern. Fitur ini dirancang untuk memberikan…

I recently completed the OSAI certification, and for me, this was one of those certifications that immediately felt relevant to where…

Program name, domain, and a few other identifying details in this writeup have been redacted at my request — the rest is exactly how it…

There are vulnerabilities that require chaining multiple weaknesses, bypassing filters, and spending hours building an exploitation path.

¿Qué es el DNS?

Introducción

A breakdown of what I actually learned, built, and got wrong on the way to becoming SOC-ready — with the receipts to prove it.

Room Link: https://tryhackme.com/room/agentsudoctf

This is a walkthrough of the Malware-Traffic-Analysis.net exercise “Infection at the Japan Field Office” (2017–06–28). The exercise —…

Your review sits quietly in the database until an admin clicks the wrong filter

Introduction

Every application accepts data.

While hunting for XSS, I found an interesting case that reminded me why understanding the application is much more important than randomly…

The FBI has taken down BreachForums three times and it’s been hacked twice. This time, it was its own mistake.

As Generative AI tools like ChatGPT, Claude, and Gemini become integral to daily engineering and organizational workflows, a critical…