Note: This challenge can be found on root-me . to comply with root-me instructions, this is only a analysis of the challenge i will not be…

Hi, I’m glad to share with you my writeup for getting first blood in 2/2 DFIR challenges.

TL;DR

This tips are from my blind xss journey.

By Zafee Chowdhury

You are a forensic analyst investigating a critical ransomware attack at a major financial institution. Your job is to analyze the memory…

You know what’s scarier than realizing you left the oven on? Discovering that the software update you just installed came gift-wrapped with…

What if your AI assistant could be tricked into leaking customer records — without breaching a single line of backend code?

A company’s security team detected unusual network activity linked to a potential malware infection. As a forensic analyst, your mission…

The Challenge

It’s an old blog which I found in my draft written 2 years back.

Unsubscribing Employee and Sending Unauthorized Message

AppSec IR Fundamentals

September 2025 was a watershed moment for the entire software development community. In the span of a few weeks, the npm ecosystem was…

This trick is called a prompt injection, and it’s one of the biggest headaches for anyone building LLM-powered apps today.

For Educational Purposes Only. Only scan hosts/networks you own or have permission to test.

What is SSRF?

The Day My Coffee Maker Tried to Hack Me

Software builds itself now. In the time it takes you to read this sentence, thousands of CI/CD pipelines have compiled code, run automated…

Lab: JWT authentication bypass via unverified signature

Does the Internet Run on Satellites? Let’s bust the myths and explore the real story.✨✨