Nibbles is a retired machine on hackthebox and also the first machine encountered in Getting Started academy module.

Introduction

As more applications are being developed, I’ve noticed a clear rise in Supabase usage. More and more teams are using it to handle…

A Tyrion404 writeup — on the difference between authentication and authorization, and why confusing the two is a very expensive mistake.

penetration Testing

Lab six in my Web Security Academy series — where the request body itself was the vulnerability

Some employees from your company reported that they can’t log into Outlook. The Exchange system admin also reported that he can’t log in to…

Agentic Bug Hunter: A Practical Guide for Bug Hunters

When I first started learning about APIs, I thought of them mainly as the systems that allow applications to communicate.

We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us.

Only if we teach them how!

In mid-September 2026, Revolut confirmed that sensitive customer data was disclosed to an unauthorized third party. The incident stemmed…

Reading Time: 7 min read

TryHackMe — The Crown Jewel Room 💎

Vulnerability Assessor

Introduction

TL;DR A KGUARD DVR vulnerability now tracked as CVE-2026-87827 carries a maximum CVSS score of 10.0. It lets an unauthenticated attacker run commands and fully take over the device. Mirai botnets …