Metodología avanzada de pentesting en APIs. Incluye fases de explotación práctica (IDOR, Mass Assignment, SSRF, JWT), mitigación y reporte.

This is a summary of the activities of hacking groups (Threat Actor Groups) analyzed based on data and information

So as with all HTB Labs, we’ll start off with our nmap scan see what ports are open and then further enumerate the ports that are..

Large Language Models (LLMs) are no longer standalone tools. They’re evolving into multi-agent systems that plan, reason, and act together…

It happened because one weak point in an e-commerce database was enough.

Ignite is a very simple room. It starts of with a simple CMS that tells you its version and further details. From there we find public…

In today’s complex digital landscape, cybersecurity is no longer confined to networks and firewalls. From credential-stuffing campaigns to…

In an era where cyber threats evolve faster than ever, businesses can no longer rely on traditional security frameworks. The need for Zero…

What is Offensive Security?

🧠 Introduction

How a Simple Email Nearly Compromised a Whole Network

kali ini kita akan mengerjakan soal boot to root lagi, disini nama soal yang akan kita kerjakan ialah Pwn The Tron: 1. challenge ini…

Hello everyone! My name is Arfat Khan, and I run a YouTube channel called Arfi Tutorials. I am a bug bounty hunter, penetration tester, and…

OFAC sanctioned 8 individuals and 2 banks linked to North Korea for laundering millions in stolen crypto and IT earnings to fund Pyongyang's WMD and missile programs.

OCI patched three critical runc flaws allowing container escape and host DoS/RCE. Attackers exploit mount race conditions in maskedPaths and /dev/console bind-mounts. Update to v1.2.8+.

Sekoia exposed a campaign exploiting compromised Booking.com/Expedia accounts to deliver PureRAT malware via a ClickFix lure. Attackers use authentic reservation details to steal guest credentials.

Cisco patched a High-severity DoS flaw (CVE-2025-20343) in ISE that allows unauthenticated remote attackers to crash the server via crafted RADIUS requests. Disable the Reject setting as a workaround.

Darktrace exposed a DragonForce RaaS attack on a manufacturer. The multi-phase intrusion used brute force and OpenVAS for recon, then exfiltrated data over SSH to a Russian-based malicious host.

AWS patched a High-severity flaw (CVE-2025-12779) in the WorkSpaces client for Linux. A local user can extract DCV authentication tokens to hijack another user’s virtual desktop session. Update to v2025.0.

ASEC exposed Cephalus, a Go-based RaaS group attacking RDP. The malware uses VirtualLock, XOR encryption, and a fake AES key pattern to severely complicate memory and forensic analysis.

tldr: bug bounty allowed me to start my career in offensive security early.