Open redirects are often labeled as “low severity,” so I didn’t pay much attention to them at first. That changed when I came across an old…

From Urban Legends to Phishing Pretexts

In November of 2025 I filed a lawsuit against multiple members of the Federal Bureau of Investigation.

Windows includes powerful built-in tools that can immediately shut down common intrusion paths. While antivirus and firewalls are…

Pigeons were historically used as spies during the Cold-War and by spies. It’s been an internet joke that modern pigeons are government…

Introduction to Web Hacking: Beyond the Myths

Hello everyone, Happy New Year and warm wishes to all of you! It feels great to be back after a long blogging break, and I’m excited to…

Uncovering the infamous PHP 8.1.0-dev backdoor and executing the User-Agent RCE! 🔓🚀

Bug Bounty is a super competitive field and if you want to stay ahead of other hunters, you need to seriously know what to look for…

Some security flaws are so simple that almost anyone can grasp them with minimal explanation. The problem is that these common weaknesses…

Master Commix to ethically detect and exploit OS Command Injection vulnerabilities in Bug Bounty programs.

This post is part of a series based on PentesterLab snippet review exercises. One article would have been too lengthy, so the series is…

Step-by-step approach: skills, platforms, report templates, and a 30/60/90 plan that actually gets you paying gigs.

Kerberos is one of those security technologies that almost everyone uses, but very few people truly understand.

Most people use CUpp as a simple wordlist generator. But in real penetration tests, CUpp becomes a precision weapon when combined with…

Passwords tell stories.

Practical lessons from controlled rogue access point testing and how defenders should respond

Lab Link: Portswigger

How weak filename checks lead to arbitrary file reads in web applications.