How I built a 50-module reconnaissance engine, and what a dozen real engagements taught me about the difference between a lot of output and…

Box: CVE-2024–48061 Difficulty:Easy

Traditionally, we have spent a lot of effort to automate a penetration test, mostly by automating individual tools. For example, Nuclei ran…

Introduction

Dell published a critical security bulletin, addressing multiple Dell ObjectScale vulnerabilities. The vendor warned that “Dell ObjectScale remediation is available for multiple security vul…

At a Glance Category Details Actor or Group Conti ransomware syndicate (Oleksii Lytvynenko) Activity Type Wire fraud conspiracy, malware development, data extortion Targets or Victims Hospitals, s…

GeoVision released a major security advisory addressing twenty-three flaws across its license plate recognition cameras on September 10, 2026. These severe GeoVision camera vulnerabilities allow a…

Dell released emergency patches to address four severe Dell Networking OS10 vulnerabilities today. These flaws allow attackers to steal user sessions, bypass access controls, and execute arbitrary…

GitLab released security updates addressing eighteen security flaws on September 10, 2026. The vendor resolved several severe GitLab vulnerabilities across Community Edition and Enterprise Edition…

TL;DR A maximum-severity SQL injection flaw sits in the Android Contacts Provider. Tracked as CVE-2026-28576 with a CVSS score of 10, it lets a permission-less app read every contact. A public pro…

Security analysts discovered active in-the-wild attacks targeting three JFrog Artifactory vulnerabilities. Threat actors chain these flaws to bypass authentication checks and obtain full administr…

Mountaineer starts with a default Nginx page hiding a broken WordPress install, and the real way in is a misconfigured alias directive that…

Task 2 — Code Review

TL;DR Walkthrough of the TryHackMe Password Cracking room and a note RE hashes.

A beginner-friendly TryHackMe OSINT Challenge

30-Second Version: Volume, slop, policy caps — the agent wave maps onto the last decade’s scanner wave beat for beat, except where it…

Most companies still test APIs like they test web apps. They run a scanner, check for SQLi and XSS, tick a box, and ship it. Then six…

Password spraying is not glamorous. There is no zero-day, no memory-corruption artistry, no elegant chain of primitives. It is a technique…

Task 2 — IIS Fingerprinting and Enumeration