In the world of bug bounty hunting and web application security, speed is everything. The initial phase of any engagement — reconnaissance…

Exploiting Insecure Output Handling in LLMs

Server-Side Template Injection in a Sandboxed Environment

On February ,I reported an interesting Cross-Site Request Forgery (CSRF) vulnerability .What made this bug unique was the impact — it…

Broken brute-force protection, multiple credentials per request

Baseado na Cyber Kill Chain by Lockheed Martin

Asking the right questions and building the discipline to gather the right data

Reproducing the tactics of APT37, this blog shows how CHM files can be weaponized for threat emulation. From lure design to reverse shell.

Think of your company’s network as a busy highway. Data flows like cars, moving from one place to another every second. Just as highways…

Why a SOC Home Lab?

It started with a simple, maddening task: trying to delete my chat history with an AI bot. What should have been a single click became a…

Introduction

Traditionally online accounts and websites required that a user enter an account ID, aka username, and a password to log in. This was…

Every organization, regardless of size, faces cyber risks. From phishing scams to ransomware, the threat landscape continues to expand. The…

Building maintainable, scalable, and production-ready security tools through proper project structuring

Com a crescente adoção de ambientes híbridos e a integração cada vez mais profunda entre o Active Directory local e o Azure AD, novos…

Internships are one of the best ways to bridge the gap between theory and practice, and my experience with Oasis Infobyte’s Internship…

TASK 1 | What is an SSRF?

GÖREV 1 | SSRF Nedir?

In this room you will learn about Web Enumeration using Gobuster. Brute forcing website for directories, dns, virtual hosts, etc.

Foreword: This is not an encomium of ImmuneFi, nor is it intended as condemnation. I write this article as constructive feedback, and in…