In recent years, penetration testing has evolved from manual recon and exploitation into highly automated workflows. But now, with the rise…

Patch Tuesday is here again, and it’s a doozy. Microsoft quietly fixed 107 CVEs on August 12, 2025[1]; including 13 Critical bugs and one…

By: Ayush

Approach:
 Connected to the lab VPN to access the target (10.201.5.107). Focused on web enumeration to find hidden directories and files…

Syllabus

Exploring how XSS can be leveraged to bypass HttpOnly cookie

A structured penetration testing report on the Athena TryHackMe room, demonstrating methodology, tools, and findings.

Exposing Stored XSS: Decoding the SMTP Error Message Exploit on XVIDEOS

Hey security enthusiasts! 👋  I’m Yamini Yadav, your Security Engineer and OSCP-certified guide through the ever-evolving maze of web…

CyberTalents — Strength Calculator write-up: A hard web challenge where I exploited a Jinja2 SSTI vulnerability to safely retrieve the…

TL;DR

Have you ever tried running commands like ls, pwd, etc. using editors like vim, vi, or even tools like awk? Well, you actually can — and…

I found sqli and html injection in IITKGP’s domain.

I have been doing a lot of labs and reading resources to understand more about XSS and techniques that come with it. Recently I came…

Aim:

Scope: CDN/API gateway/reverse proxy/ingress/service-mesh layers (Cloudflare, Akamai, Fastly, CloudFront/ALB/APIGW, Azure Front Door…

TL;DR Walkthrough of the VulnNet: Active TryHackMe room.

What is the first flag you receive after successfully detecting sample1.exe?

by Ayush

While testing an API endpoint with a colleague, a single quote accidentally slipped into a parameter — and the server responded…

Hello! I’m new to bug bounty hunting and security research, and this post is about my experience in finding and reporting my first serious security vulnerability for a site listed on…