The AI-security corner of GitHub is moving too fast for its own good.

How a single unescaped < character can hijack a victim's password reset token 🕵️‍♂️

Rethinking the daily toolkit for security testing, research, and API exploration.

Unauthenticated Blind SQL Injection via a Sort Parameter Hello everyone 👋 While testing a web application in scope for a private program, I came across a REST API endpoint used to return a list of …

My practical reconnaissance checklist for authorized security testing

A Django SSTI chain that completely bypasses the intended approval and bot workflow

Welcome to this new Medium post. In this article, we’ll extend the File Handle Redirection technique to target a Domain Controller…

Room: HA Joker CTF Platform: TryHackMe Difficulty: Medium Category: Web Enumeration → Brute Force → Hash Cracking → Reverse Shell →…

After Completing the eWPTv2 Certification Content, Here’s Everything You Need to Know About It

Initial Enumeration

Task 1 : IR Scenario

From SQLi To Gain Root Access

A toxic relationship is just a protocol mismatch with extra feelings.

Lab Information

Behind the Shadows of the Dark Web: The Fall of “Orphan” and the Deception of G91 In the deepest corridors of Tor networks and end-to-end…

Hack The Box — Responder

How a leaky robots.txt, a filtered command execution bug, and one very generous sudoers file led me from anonymous visitor to root.

Between September 7 and September 13, 2026, our tracker logged 3,856 new CVEs. This weekly CVE report focuses on the 19 flaws that Daily Cybersecurity flagged as exploited. Ten later reached the C…

At a Glance Actor or Group: Suspected state-sponsored groups (UNC6508, BASIN CASTLE) and cyber criminals (UNC6780). Activity Type: Open source supply chain compromise, AI credential harvesting, an…

At a Glance Security researchers at Gen Threat Labs discovered a critical remote code execution flaw in Sogou Input Method. This software serves as one of the most widely used typing tools in Chin…