High-Port Reconnaissance & Flag Discovery

Monitoring Active Directory: Understanding Authentication Events, Baselines, and Audit Policies Active Directory (also known as AD) is the technology used by most companies to administer users …

Hackfinity Battle 2025 — PWN: Breaking a “Fixed” Format String Vulnerability

When I first started learning backend development, security felt like a separate topic.

Why authentication isn’t enough and where authorization actually belongs.

I’m glad I tried that.

ConnectWise released an emergency security patch today to address a critical ConnectWise ScreenConnect vulnerability. The severe flaw allows unauthorized attackers to transfer and execute maliciou…

Bug bounty hunting is not just about finding vulnerabilities. A large part of the process involves reconnaissance, attack-surface…

Hack Smarter World Walkthrough

The Handle That Was Never a Mystery Vanity Fair said LionAW “has never been identified.” The Old Bailey put the alias in a terrorism case in 2020. Treating that gap as a joke is not clever. It is …

DJ-Classifieds is a Joomla extension created by DJ-Extensions. It transforms a Joomla site into an advertising or classifieds platform…

This is how, I got root in Bounty Hacker.

Q1: What is the name of the file stored on a domain controller that contains the password hashes of all domain accounts? (Format: ****.***)

Hidden sub-states, multi-endpoint attacks and single-endpoint password reset races - the deeper side of race conditions.

Rate limiting is a fundamental defense mechanism designed to protect sensitive endpoints — such as login forms, password reset requests…

Introduction:

Remove Record

The scapegoat is convenient. It’s also wrong.

Six checks, in order, on the phone you’re holding. Plus the safety warning to read before you touch any of them.