Box: Casino Difficulty: Medium Note: Much thanks to Tyler for giving me free access to the platform to help me prepare for the OSCP !

30-Second Version: One SSRF bypass technique — a single HTTP redirect — worked against Infogram (2017), Slack (2018), Bitwarden (2020), and…

Stop Memorizing HTTP Methods: A Deep Dive into Web Security Semantics 🔐 Let’s be real: you can’t truly master Web Application Security or Bug Bounty if you treat HTTP methods like an …

Bonjour was a clean machine that used a subtle information leak via mDNS (Bonjour) to provide SSH credentials, and then relied on a single…

What if I told you that your browser — yes, the very thing you’re using right now — could become the weakest link in your security chain…

Web application vulnerabilities rarely exist in isolation.

What’s up everyone! Nitin here

How “Hello, {name}” turns into remote code execution.

A simple Wayback Machine recon uncovered archived pages exposing an estimated 44,560 job applicant emails, highlighting the risks of…

A beginner's journey from self-doubt and endless overthinking to taking action and conducting my first real web security investigation.