How a critical Bricks Builder vulnerability led from a single unauthenticated request to a cryptocurrency miner tied to the LockBit…

A Practical Security Assessment of OWASP crAPI: Identifying and Exploiting API Security Vulnerabilities

This blog is completely dedicated to the MBR & GPT Analysis, but before diving in the analysis it is important to understand the MBR & GPT…

Phishing is More Than Spam

How much of AI can we actually know and how its security gonna be affected?

Weighing the career benefits against the mental toll of doom-scrolling

TL;DR Two Accenture researchers showed that plugging a USB device into Windows can hand an attacker SYSTEM. The chain needs no admin rights and no logged-in user. Both the vulnerability details an…

A beginner-friendly, practical walkthrough of how NoSQL injection works, why it’s often overlooked, and how to actually test for it.

Bug bounty hunting is often described as a process of finding vulnerabilities.

Part 5 of our Android security series. Part 4 covered Secure Logging — this post covers the other half of CRYPTO: where your encryption…

Assume someone hostile is paying attention.

While the OWASP Top 10 serves as an industry benchmark for web security, restricting application security testing solely to OWASP risks…

During a pentest I found a JavaScript file that led to me an API with exposed Swagger. Once account creation later I was an Admin.

This guide covers the exploitation of the Infinity Pool room. The process involves command injection, credential discovery, and privilege…

It was late in the evening when I opened the Android application for the tenth time.

ColddBox: Easy — TryHackMe WriteUp with Flags Date: 10/01/2026 Room Link: https://tryhackme.com/room/colddboxeasy My Profile: https://tryhackme.com/p/RayenHafsawy 🧭 Introduction This …

TASK — 01: CHALLENGE

Recon

Retrocompatibility is a vulnerability

You found an IP address.