I first performed a ping scan of my virtual network to get the IP address of the target. I performed a ping scan with no port scanning…

Many security bugs happen because engineers confuse intent.

Unused or undocumented API endpoints can often be leveraged to break application logic

An XSS vulnerability exists in DeepSeeks AI where user input is rendered without proper sanitization. Submitting JavaScript code (e.g…

Exploit Internal Servers via Referer Header Injection.

Introduction

Where to start bug hunting when you want real chances, not endless duplicates

HTTP has a problem, anyone that’s in the middle between source and destination can easily intercept and take a look the transferred data…

https://github.com/MartinxMax/trp00f

How to maintain true privacy and reduce telemetry data leakage. For NGO’s, Activists, and the former NSA engineers.

Overview

A deep dive into modern phishing campaigns exploiting trusted infrastructure

1 — Introduction

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

In bug bounty hunting, encountering a 403 Forbidden error is not a dead end it’s a challenge. It means there is something hidden behind…

Exploiting Parameter Driven Authorization Logic in Authenticated APIs This write up describes the discovery and exploitation of a server side authorization issue caused by trusting identity data …

1/2/20262 min read