Author: Ratbully Platform: bWAPP (Broken Web Application) Lab/Module: Broken Auth, Weak Passwords Category: Broken Authentication / Weak…

What a token proves, how an app gets one, and when a server session is simpler.

SQL injection is one of the oldest and most dangerous web vulnerabilities, and it is still everywhere. In this writeup I walk through four…

Documenting my practical bug hunting journey, methodology, and payloads for labs 1–6

From Secure Coding and Token Management to Cyberattacks, Prevention, and Incident Response

Series: From P4 to P1: The Bug Hunter’s Journey Day: 07/30 Topic: IDOR, BOLA, Access Control Testing, and Manual Validation

A race condition in the core updater, a pile of stored XSS bugs and the third major patch week of October. Here’s what changed and what to…

Overview

Most people test web apps by clicking around. The frontend is polished, the buttons do what they say, and everything looks fine.

JSON Web Tokens (JWT) are the backbone of authentication in modern APIs, single page applications, and microservice architectures. They are…

A 50-line toy API, seven classic security holes, and the exact responses before and after patching.

Author: Affanhaxor Platform: CyLab Security Academy Category: Web Exploitation Challenge: SQLMap 1 Topic: SQL Injection, Database…

Scope of this post: this is Part 1, covering error-based/in-band SQLi through two beginner labs. Part 2 will cover UNION-based and Blind…

Imagine being able to extract the admin credentials of a massive e-commerce platform without even logging in. No user interaction, no…

Difficulty: Practitioner

Web application security is an important part of cybersecurity. Modern applications handle sensitive information, user accounts…

Difficulty: Practitioner

Getting a valid UUID

Token theft cannot be fully stopped, so the goal is to make a stolen token short-lived, hard to reuse from another device, and quick to…

On Thursday afternoon, Polymarket’s international site was serving code that nobody at Polymarket wrote. It came in through a script that…