Executive Summary

Imagine typing one prompt like:

Pool Party — OSINT

Hello, welcome to a Fool’s guide to Krybit and their ransomware turf war. Krybit as a group have been active since March 2026 and operate a…

I read an email response from Revolute concerning their breach that led to sensitive customer data being stolen.

A beginner-friendly walkthrough of WhatsMyName, the OSINT tool that shows just how much of “you” is already public.

As security researchers, we often spend our days hunting for the flashy bugs. We look for complex Cross-Site Scripting (XSS) payloads, hunt…

How a missing object-level authorization check allowed authenticated users to access other users’ deposit data and transaction history

Task 2

By Sourav Bouri | B.Tech CSE (IOT CS BCT) Student | Cybersecurity Enthusiast

A field note from a penetration tester on discovering — and responsibly disclosing — a reflected XSS vulnerability on a live job-search…

The AI-security corner of GitHub is moving too fast for its own good.

How a single unescaped < character can hijack a victim's password reset token 🕵️‍♂️

Rethinking the daily toolkit for security testing, research, and API exploration.

Unauthenticated Blind SQL Injection via a Sort Parameter Hello everyone 👋 While testing a web application in scope for a private program, I came across a REST API endpoint used to return a list of …

My practical reconnaissance checklist for authorized security testing

A Django SSTI chain that completely bypasses the intended approval and bot workflow

Welcome to this new Medium post. In this article, we’ll extend the File Handle Redirection technique to target a Domain Controller…