XSS saldırıları, bir web uygulamasının kullanıcı girdilerini yeterince doğrulamadığı ve filtrelemediği durumlarda ortaya çıkar.

CSRF (Cross-Site Request Forgery)

Insecure direct object references (IDOR) bir erişim kontrolü zâfiyetidir. bir uygulamanın nesnelere doğrudan erişmek için kullanıcı…

Sharing cybersecurity, GRC, tech law, and practical InfoSec insights — written simply and clearly.

Hello! I’m an aspiring pentester and cybersecurity researcher, and I regularly practice on VulnHub machines to sharpen my skills. While…

Cybersecurity today is more than a career path — it’s a real-world mission. Every organization, big or small, is dealing with constant…

This article is a write up on the Mobile Hacking Lab “Post Board” challenge, where the main objective is to exploit a Cross Site Scripting…

This write-up details the solution for the Intigriti Challenge 1125. Unlike standard technical reports, this post focuses on the…

The 11.10.25 Crystal Palace release added more new commands in one go than I think I've seen thus far. Many of them seemed really similar at first blush, and it took me a while to get an understanding of where each one is applicable (I failed in that

A Critical DLL Hijacking flaw (CVE-2025-13051) in ASUSTOR Backup Plan/EZSync allows local attackers to gain SYSTEM privileges by planting a malicious DLL in a user-writable path. Update immediately.

A Critical DoS flaw (CVE-2025-65015) in joserfc allows unauthenticated attackers to overwhelm log/SIEM systems by injecting massive JWT payloads into exception messages.

CISA, NSA, and FBI released a guide to dismantle Bulletproof Hosting (BPH) networks. It advises ISPs on precision filtering and stricter vetting to curb infrastructure used by ransomware and phishing campaigns.

A deep-dive on Lazarus’s ScoringMathTea RAT reveals a full reflective DLL injection system, TEA/XTEA C2 encryption, and a polyalphabetic cipher for API hashing—a highly evasive tool for espionage.

A 42-day Akira ransomware attack started with one ClickFix CAPTCHA that deployed SectopRAT. The attackers went undetected despite EDRs, stealing 1 TB and deleting cloud storage backups.

Cybereason exposed The Gentlemen, a new, technically advanced Go-based RaaS using XChaCha20/Curve25519 crypto. The group claimed 48 victims in 3 months, leveraging WMI and PowerShell for propagation.

Trend Research warns that ransomware is shifting to AWS S3, exploiting misconfigured IAM and SSE-C keys in five attack variants to cause irreversible data loss and cloud-native extortion.

Broadcom exposed a group deploying multiple RMM tools (ScreenConnect, LogMeIn, Naverisk) weeks apart to achieve redundant persistence. The likely Initial Access Broker (IAB) prepares systems for resale.

Apache patched a Critical RCE flaw (CVE-2025-64408) in Causeway allowing authenticated attackers to execute arbitrary code via Java deserialization in the ViewModel component. Update to v3.5.0.

Microsoft will introduce a feature for public display systems (digital signage) to hide crash screens (BSOD) after 15 seconds, making the system appear off rather than crashed.