Photo by Nguyen Dang Hoang Nhu on Unsplash

Pentesting is not just technical. It is emotional.

A simple logic flaw in Pixiv’s password reset flow enabled unrestricted verification code brute-forcing — earning a $1000 bounty

When I first got into bug bounty hunting, I used to think finding big bugs required fancy payloads and hardcore exploitation skills. But…

A simple plugin path traversal exposed sensitive server files on a public dashboard

🚀 Introduction: Why You Need Your Own Hacking Lab

I found a bug — but it was marked as duplicate. Here’s how I did it.

Scan for secrets using regex+entropy with LLM

In today’s fast-paced development world, security engineers face constant pressure to keep up with rapid releases, shifting priorities, and…

My Background

Introduction  On 26 July 2025 Allianz Life Insurance Company of North America revealed that hackers had stolen personal data on most of…

Learn how YouTube channels are being hacked, see real examples from 2025, and implement proven protection & recovery strategies.

🐟 It Started with a Joke… and Ended in Disaster

🧊 It Started With a Chill…

Recently I had a really great time investigating this Digital Forensics and Incident Response Challenge by CyberDefenders. It lasted about…

Recently, a user triggered multiple alerts after downloading several potentially unwanted applications (PUAs), prompting concern from the…

pretender to obtain machine-in-the-middle positions via spoofed local name resolution and DHCPv6 DNS takeover attacks

Aqua Security's Nautilus team discovered Koske, an advanced Linux cryptojacker likely crafted by AI, hiding in panda images and using rootkits for stealthy operations.

Continuando con la vulnerabilidad SQLi, en esta ocasión tocaremos principalmente el Bypass de un sistema de autenticación por medio de…

🧠 Boring Recon That Led Somewhere Interesting