The attack didn’t need your password. It didn’t need you to click anything. It just needed your AI to do exactly what it was designed to…

This is the 2nd part in a two-part series on JWT security. If you haven’t read Part 1 of this series, I recommend checking that out first…

It’s just base64 and a bit of math.

# Phantom Fob — CAN Bus Rolling-Code Forgery

Progress Software published a critical security bulletin, disclosing a maximum-severity flaw. The newly identified Chef Automate vulnerability allows unauthenticated attackers to gain elevated pri…

Entre 2020 y 2026, la ciberseguridad dejó de ser un asunto limitado al área técnica. La aceleración del trabajo remoto, la adopción de…

An authorized security audit of a small web store that had no backend to attack.

TL;DR Walkthrough of the TryHackMe Metasploit Scanning & Exploitation room.

Every cybersecurity subreddit, Discord, and LinkedIn comment section has the same thread running on loop: “Which cert should I get first?”…

The CRTA lab starts simple: an e-commerce website on a public IP. It ends with a golden ticket, a fully dumped NTDS, and admin on two…

An intermediate, practical guide on bash commands. Day 7 of our Ethical Hacking Journal.

A structured reference for learning Burp Suite: architecture, every core tool, key features, and the Linux commands that pair with it…

Cafe Club — Inject all the things.

(“What’s Actually Inside the Register?”)

*A fast, practical walk-through on reverse engineering Dalvik bytecode and exploiting CWE-798 in production mobile apps.*

One thing I think cloud security teams sometimes underestimate is how quickly a “web application issue” can stop being an application…

Objective

Welcome to my walkthrough for the LLMborghini challenge room on TryHackMe! In this room, we examine the security risks associated with…

High-Port Reconnaissance & Flag Discovery

Monitoring Active Directory: Understanding Authentication Events, Baselines, and Audit Policies Active Directory (also known as AD) is the technology used by most companies to administer users …

Hackfinity Battle 2025 — PWN: Breaking a “Fixed” Format String Vulnerability