There are lots of web app security tools. Some of them are very well known, like BurpSuite, Nmap, Nuclei, ffuf, etc, whilst others, even…

Introducing Pillage Suite — a toolset to enumerate, index and analyze effective permissions and file contents in all your network shares

Hello readers, Thank you for taking the time to read my write-up. Today, I want to share one of my bug hunting findings. While it was…

A new report reveals ransomware is shifting from encryption to "quiet" tactics like credential theft and data exfiltration, rendering traditional defenses ineffective.

Two critical vulnerabilities (CVSS 10 & 9.8) in Digiever NVRs allow unauthenticated attackers to steal credentials and execute commands. Update your firmware immediately.

Misconceptions About Immediate Use

A new worm, Shai-Hulud, has compromised CrowdStrike’s NPM packages. The malware steals credentials and can spread rapidly across the developer ecosystem.

Two popular apps, one for healthcare and one for jewelry, are leaking sensitive user data over unencrypted connections. Learn how this vulnerability puts you at risk.

Today, we’re diving into a topic you’ve probably heard about but might be hesitant to explore in depth: Mimikatz and its advanced…

New PhantomRaven npm malware uses AI "slopsquatting" and invisible dynamic dependencies to steal GitHub, GitLab, and CI/CD tokens. Update vigilance now.

With many new faces in the coding communtiy, one problem has been appearing more and more. Developers hard-code their secrets (API-Keys…

Vulnerability Assessment and Penetration Test Report

There are lots of web app security tools. Some of them are very well known, like BurpSuite, Nmap, Nuclei, ffuf, etc, whilst others, even…

SantaStealer, a new MaaS info-stealer, is being aggressively marketed on the dark web. It's a BluelineStealer rebrand that uses C code and open-source libraries to steal crypto wallets and credentials, despite having amateur anti-analysis features.

Hi everyone, it’s me pr1vacy from Abyssal Hunter.
Today, I’m sharing a write-up on how I turned my recon phase into an AWS and DB…

Credential exposures are one of the fastest paths to compromise. In 2024 alone, GitHub detected over 39M leaked secrets across its…

Halo guys, ini tulisan pertama gw semoga membantu :)

Machine Name: CAP Difficulty: Easy Operating System: Linux Category: Web / Credential Reuse / Linux Capabilities Author: Achraf Nouri Cap is an easy Linux machine that demonstrates several …

Adversaries have once again targeted the npm supply chain, though this incursion pursued a surgical and perilous objective: