Introduction

Hi everyone, I’m Sirat, a bug hunter and security researcher.
Recently, I released a new tool called Skybrute, which is designed to…

During bug bounty hunting, you might exploit a vulnerability such as Command Injection or Remote Code Execution (RCE) and successfully gain…

HackerOne’s Hacker101 easy level CTF walkthrough

Secure by Default: Practical Web App Security Checklist Security that actually gets used is security that fits the size and speed of your team. Secure by default is not a slogan, it is a product …

This lab demonstrates how poorly implemented URL-based access control can be bypassed using HTTP headers like X-Original-URL or…

Hi all! Today, we’ll be solving the first Web Cache Deception lab of the PortSwigger Web Security Academy. Let’s get started!

Security researchers have demonstrated a new method to bypass Web Application Firewalls (WAFs) using a combination of JavaScript injection…

Most intentionally vulnerable applications we know and use for training like DVWA, Juice Shop, and WebGoat are written in PHP , Node.JS…

Hackers aren’t always looking for the big, cinematic breach. More often, they’re poking around for the lazy gaps - the missed validation…

Modern microservices often expose APIs for downloading reports, logs, or documents.

Mentorship has always been close to my heart. Over the years of working in cybersecurity particularly in application security and…

and tricking my Audience

National Push Your Car to Work Day.

Welcome to the WhyWriteUps articles, where we explain every step we made and why we made it. I have been solving machines for quite a bit…

TLDR: Foothold — OpenSMTPD public exploit; Privesc — NIL

RECON 🕵️‍♂️

When most organizations think of reconnaissance, they imagine noisy port scans or brute-force login attempts hammering their perimeter. Few…

I understand how lengthy is the process of gathering information and then exploiting and getting access but it is also important to erase…

The latest npm compromise showed how a tiny change deep in a dependency supply chain can rewrite what users see, sign, and send.