Mass assignment, a JWT key-confusion forge, and an old ImageMagick bug — stitched together into a root shell.

SQL Injection vs. XSS vs. CSRF: 1 Million Users in 20 Hours and a £400,000 Fine

Platform: CTF (HACKTHEBOX) Category: Web Security Difficulty: Learning through practical testing

Introduction

introduction

My practical learning experience with HTTP requests, cookies, Base64 encoding, and session-token security.

You can secure your login page with everything you’ve got. But what happens when someone clicks “Forgot Password”?

A mathematical, algorithmic, and architectural deep dive into why naive scanners drown in false positives, how HTML5 state machine parsing…

How I found my first resolved vulnerability after duplicates and informative reports.

A practitioner’s walk through SAST, DAST, manual pentesting and the OWASP checklist, and how to layer them so gaps don’t line up.