From CTF flags to real-world bugs — your next hacking adventure starts here.

Cross-Site Scripting (XSS) remains one of the most prevalent web vulnerabilities.

Kali Linux’s latest release, 2025.3, introduces a fascinating experiment in AI‑assisted security tooling: llm-tools-nmap. This plugin…

Disclaimer

One file, two architectures. I used the Unicorn Engine to emulate a polyglot binary on x86 & ARM to win a CTF. Here’s the breakdown.

Today, we continue the CPTS-OSCP series with the fourth write-up: HackTheBox’s Active machine. The target runs Windows and is rated Easy…

Lightweight reconnaissance and metadata extraction — no bulky frameworks, no setup pain.

C2 (Command & Control) is the “remote brain” attackers use to talk to compromised hosts.

is a cryptographic network protocol that provides standard secure (method/tunnel) to remotely access and manage devices (eg. switches and…

In OSINT and cybersecurity, obscurity isn’t weakness — it’s armor.

Summary  In mid 2025, a class of insecure file-handling mistakes in the popular WordPress plugin FileAway (and several forked/derived…

Introduction

Hi, I hope you all are doing well.

Here, we have a log-in page, and the challenge’s title is called “SQLiLite.” So we already know that the vulnerability here is SQL…

Building Your Digital Fortress Against Database Saboteurs

tl;dr - repo here.

The Crystal Kit is an experimental project designed to replace Cobalt Strike's Sleepmask. The Sleepmask (and BeaconGate) are key to Beacon's runtime evasion strategy - not only does it mask Beacon's memory, it also acts as an API proxy…

Date: October 5, 2025
Subject: Unauthorized Administrative Access Leading to Critical Information Disclosure

📺 Ver vídeo completo: https://www.youtube.com/watch?v=XJyf2jI9Hpc?si=czSRsC-zAc08FSfk

When a Simple Avatar Upload Became a Server Takeover: File Upload Vulnerabilities Explained

في عالم الجرائم الإلكترونية المتسارع، أصبحت الحاجة إلى مصادر معلوماتية دقيقة ومباشرة أمراً أساسياً لفهم التطورات في مجال الأمن السيبراني…