Introduction

Author: Affanhaxor Platform: CyLab Security Academy Category: Web Exploitation Topic: Regular Expressions (Regex), Client-Side JavaScript…

Series: From P4 to P1: The Bug Hunter’s Journey Day: 03/30 Topic: Error Handling, Information Disclosure, and Manual Validation

Alertes zero-day : 17 vulnérabilités critiques du 26 octobre 2026 (dont PHP) Failles 0-day, correctifs d’urgence et vulnérabilités exploitées : le bilan technique des 17 alertes de la semaine …

1. Vulnerability Description

One Chat Message, One Security Bug: My Stored XSS Hunting Story 🔥

Cookie Cutter challenge on WebVerse Labs.

Why I created the Smart Contract Security Research Handbook — a practical guide to adversarial auditing, DeFi vulnerability discovery…

Imagine asking an AI assistant to research three laptops, compare their prices and specifications, and recommend the best one for your…

Objective

A practical bug bounty story about testing authorization, manipulating request parameters, and finding a potential IDOR vulnerability.

بسم الله الرحمن الرحيم

You have access to a Windows machine during a penetration test — but you don’t have administrator privileges. What happens next? 🔥

Everything you need to understand, find, and exploit Server-Side Request Forgery — written for beginners, detailed enough for professionals

A coding agent reads a repository to understand the task. An attacker can use the same repository to give it a second task.

I went through publicly disclosed XSS reports from HackerOne, GitLab, LinkedIn, Apple and more — here’s the pattern behind every single one

بسم الله الرحمن الرحيم — وَمَا بِكُم مِّن نِّعْمَةٍ فَمِنَ اللَّهِ

Every password reset flow makes the same implicit promise: the link in your inbox is the only way in, because the token inside it could not…

How to spot, confirm, and fix SSRF, SSTI, SSI, and XSLT injection.