Complete Fix & Installation Guide

Web uygulamalarının güvenliğinde kimlik doğrulama (authentication) kritik bir rol oynar. İnternete bağlı herkesin erişebileceği…

A complete BloodHound Legacy + PlumHound setup for Kali Linux 2024/2025 — with all the fixes the old tutorials forget to mention

Most people don’t think about password managers until something scary happens.

Hey guys. Back again with another bug which was founded in a chat platform. A race condition which allowed us to send unlimited message to…

VAI CORINTHIANS!

XSS saldırıları, bir web uygulamasının kullanıcı girdilerini yeterince doğrulamadığı ve filtrelemediği durumlarda ortaya çıkar.

CSRF (Cross-Site Request Forgery)

Insecure direct object references (IDOR) bir erişim kontrolü zâfiyetidir. bir uygulamanın nesnelere doğrudan erişmek için kullanıcı…

Sharing cybersecurity, GRC, tech law, and practical InfoSec insights — written simply and clearly.

Hello! I’m an aspiring pentester and cybersecurity researcher, and I regularly practice on VulnHub machines to sharpen my skills. While…

Cybersecurity today is more than a career path — it’s a real-world mission. Every organization, big or small, is dealing with constant…

This article is a write up on the Mobile Hacking Lab “Post Board” challenge, where the main objective is to exploit a Cross Site Scripting…

This write-up details the solution for the Intigriti Challenge 1125. Unlike standard technical reports, this post focuses on the…

The 11.10.25 Crystal Palace release added more new commands in one go than I think I've seen thus far. Many of them seemed really similar at first blush, and it took me a while to get an understanding of where each one is applicable (I failed in that

A Critical DLL Hijacking flaw (CVE-2025-13051) in ASUSTOR Backup Plan/EZSync allows local attackers to gain SYSTEM privileges by planting a malicious DLL in a user-writable path. Update immediately.

A Critical DoS flaw (CVE-2025-65015) in joserfc allows unauthenticated attackers to overwhelm log/SIEM systems by injecting massive JWT payloads into exception messages.

CISA, NSA, and FBI released a guide to dismantle Bulletproof Hosting (BPH) networks. It advises ISPs on precision filtering and stricter vetting to curb infrastructure used by ransomware and phishing campaigns.

A deep-dive on Lazarus’s ScoringMathTea RAT reveals a full reflective DLL injection system, TEA/XTEA C2 encryption, and a polyalphabetic cipher for API hashing—a highly evasive tool for espionage.

A 42-day Akira ransomware attack started with one ClickFix CAPTCHA that deployed SectopRAT. The attackers went undetected despite EDRs, stealing 1 TB and deleting cloud storage backups.