What I was told, what I can verify, and what I’m choosing to do about it.

Recently, I felt like flexing some web exploitation skills and decided to warm up with a classic: uploading a web shell, getting code…

🚨 HP ThinPro’s “Encrypted” Thin Clients Aren’t as Secure as You Think

The conventional privacy playbook is familiar: use a VPN, encrypt your traffic, hide your IP address, and minimize the information you…

Continuation of the previous Linux Privilege Escalation lab.

Hacker Holidays 2026 — Day 12

Hacker Holidays 2026 — Day 14 Category: Forensics | Difficulty: Hard

Task 1: Introduction

A Brand New HTTP Method That Solved the Complex Problem of the Internet and Became an Evolution

If you’re learning web application security, there’s a good chance you’ve heard about SQL injection a hundred times before you actually do…

ReconRaptorAI is a reconnaissance workflow for authorised security testing that keeps the useful output separate from the noise.

A walkthrough of a server-side validation bypass I found while testing a “create new collector” workflow, and why relying on the UI to…

I used to measure a good bug bounty session by how much recon data I collected.

The Privilege Model

Introduction

Challenge Summary

A walkthrough of TryHackMe’s “Management Wants a Word” (Hacker Holidays 2026, Day 14 — Forensics, Hard).

During a recent authorized security assessment of a live (Private), AI-powered healthcare management platform, I identified a critical…

Most API security programs are built around one assumption: if an API matters, it eventually shows up in traffic that crosses the…

Difficulty: Apprentice
Category: Broken Access Control — Missing Function-Level Access Control

Listening and reading are not enough; you need to practice what you’ve learned so far. Let me give you a quick analogy: There is a guy who…