Secure by Default: Practical Web App Security Checklist Security that actually gets used is security that fits the size and speed of your team. Secure by default is not a slogan, it is a product …

This lab demonstrates how poorly implemented URL-based access control can be bypassed using HTTP headers like X-Original-URL or…

Hi all! Today, we’ll be solving the first Web Cache Deception lab of the PortSwigger Web Security Academy. Let’s get started!

Security researchers have demonstrated a new method to bypass Web Application Firewalls (WAFs) using a combination of JavaScript injection…

Most intentionally vulnerable applications we know and use for training like DVWA, Juice Shop, and WebGoat are written in PHP , Node.JS…

Hackers aren’t always looking for the big, cinematic breach. More often, they’re poking around for the lazy gaps - the missed validation…

Modern microservices often expose APIs for downloading reports, logs, or documents.

Mentorship has always been close to my heart. Over the years of working in cybersecurity particularly in application security and…

and tricking my Audience

National Push Your Car to Work Day.

Welcome to the WhyWriteUps articles, where we explain every step we made and why we made it. I have been solving machines for quite a bit…

TLDR: Foothold — OpenSMTPD public exploit; Privesc — NIL

RECON 🕵️‍♂️

When most organizations think of reconnaissance, they imagine noisy port scans or brute-force login attempts hammering their perimeter. Few…

I understand how lengthy is the process of gathering information and then exploiting and getting access but it is also important to erase…

The latest npm compromise showed how a tiny change deep in a dependency supply chain can rewrite what users see, sign, and send.

In early September 2025, a supply chain attack hit the JavaScript ecosystem, targeting crypto users through the NPM package repository…

The landscape of digital operations is continuously reshaped by the increasing sophistication of cyber threats, making robust cybersecurity…

Attackers still start with stealer logs. These dumps contain url:user:pass in plain text. Do a fast 2 minute check:

Author: Berend Watchus September 9, 2025 Blog article

In this part of the Mastering Modern Red Teaming Infrastructure series, we introduce SilentMind-AI-C2. an AI-powered Command & Control…