Wordpress Hacking

All You Need To Know . Learning With Live Targets !Continue reading on Medium »
Read more...

How I Discover what Developers Forgot to Secure(Bug Bounty)
https://medium.com/@thenewdate24/how-i-discover-what-developers-forgot-to-secure-bug-bounty-cce0468031aa?source=rss------bug_bounty-5

Some of the most impactful vulnerabilities are not complex, they exist because of simple mistakes. Hidden files and endpoints are often…Continue reading on Medium » (https://medium.com/@thenewdate24/how-i-discover-what-developers-forgot-to-secure-bug-bounty-cce0468031aa?source=rss------bug_bounty-5)

Wordpress Hacking
https://d0natel00.medium.com/wordpress-hacking-599bf729e738?source=rss------bug_bounty-5

All You Need To Know . Learning With Live Targets !Continue reading on Medium » (https://d0natel00.medium.com/wordpress-hacking-599bf729e738?source=rss------bug_bounty-5)

$500 in just a single IDOR

Hey Everyone!Continue reading on Medium »
Read more...

$500 in just a single IDOR
https://medium.com/@Muhammad_Wageh/500-in-just-a-single-idor-b13e9df22f4a?source=rss------bug_bounty-5

Hey Everyone!Continue reading on Medium » (https://medium.com/@Muhammad_Wageh/500-in-just-a-single-idor-b13e9df22f4a?source=rss------bug_bounty-5)

How I Chained Mass Assignment and CSV Injection to Exfiltrate Corporate Data

IntroductionContinue reading on System Weakness »
Read more...

Authentication Bypass & Username Enumeration in AdminPanel (Jason2605)

Continue reading on Medium »
Read more...

Blind SQL Injection in Yahoo!

In 2014, Stefano Vettorazzi discovered a significant vulnerability in Boolean-based blind SQL.affecting the Yahoo! Sports draft endpoint.Continue reading on Medium »
Read more...

Deterministic Network Halt: How a Nil Pointer in BSC Geth Can Stop a Blockchain

Introduction In the high-stakes world of blockchain security, the spotlight usually falls on clever DeFi flash loan exploits or complex…Continue reading on Block Magnates »
Read more...

Resolute | HackTheBox | OSCP Preparation

Firstly, we start off by setting our environment variable $target to the machine’s IP so as we don’t have to manually type its IPContinue reading on Medium »
Read more...

Hacking NASA Without a Login: How One Clojure Function Gave Me Root Access

You get used to looking at a lot of source code when bug hunting. Most of the time it’s a grind, but every once in a while, you spot…Continue reading on Medium »
Read more...

(ab)using windows toast notification for fun and user manipulation
https://www.reddit.com/r/redteamsec/comments/1rys5zy/abusing_windows_toast_notification_for_fun_and/

<!-- SC_OFF -->During some free time I ended up doing some research on something I never really thought about before: using Windows toast notifications for user manipulation. I ended up writing a BOF and a blog post about it, hope it's useful. Blog post: https://brmk.me/2026/03/18/toast-my-way.html BOF: https://github.com/brmkit/toastnotify-bof <!-- SC_ON --> submitted by /u/brmkit (https://www.reddit.com/user/brmkit)
[link] (https://brmk.me/2026/03/18/toast-my-way.html) [comments] (https://www.reddit.com/r/redteamsec/comments/1rys5zy/abusing_windows_toast_notification_for_fun_and/)

AI agent hacked McKinsey's chatbot and gained full read-write access in just two hours
https://www.reddit.com/r/redteamsec/comments/1ryummv/ai_agent_hacked_mckinseys_chatbot_and_gained_full/

<!-- SC_OFF -->A new report from The Register reveals that an autonomous AI agent built by security startup CodeWall successfully hacked into the internal AI platform Lilli used by McKinsey in just two hours. Operating entirely without human input the offensive AI discovered exposed endpoints and a severe SQL injection vulnerability granting it full read and write access to millions of highly confidential chat messages strategy documents and system prompts. <!-- SC_ON --> submitted by /u/EchoOfOppenheimer (https://www.reddit.com/user/EchoOfOppenheimer)
[link] (https://www.theregister.com/2026/03/09/mckinsey_ai_chatbot_hacked/) [comments] (https://www.reddit.com/r/redteamsec/comments/1ryummv/ai_agent_hacked_mckinseys_chatbot_and_gained_full/)

SMTPwn, an SMTP user enumeration tool I built for pentesting engagements
https://www.reddit.com/r/Pentesting/comments/1ryrywt/smtpwn_an_smtp_user_enumeration_tool_i_built_for/

<!-- SC_OFF -->**[Tool Release] SMTPwn — SMTP User Enumeration & Relay Testing Tool** Just released SMTPwn, an SMTP user enumeration tool I built for pentesting engagements. **What it does:** Abuses the SMTP protocol to enumerate valid usernames on a mail server using VRFY, RCPT TO, and EXPN. Has a BOTH mode that requires a user to pass both VRFY and RCPT — cuts false positives on catch-all servers significantly. **Key features:** - Pre-flight probe that detects catch-all / open relay configs before scanning - Automatic EHLO/HELO negotiation with fallback - RSET state management between checks — no transaction bleed - Tunable delay, timeout, and batch size to stay under the radar - Pure Python stdlib — zero dependencies **Example:** ``` python3 smtp_enum.py -t 10.10.10.10 -d target.com -w users.txt -m RCPT ``` Tested against Postfix, Sendmail, Exchange, and HMailServer. GitHub: https://github.com/marcabounader/SMTPwn Feedback and PRs welcome. <!-- SC_ON --> submitted by /u/Frequent_Culture_782 (https://www.reddit.com/user/Frequent_Culture_782)
[link] (https://www.reddit.com/r/Pentesting/comments/1ryrywt/smtpwn_an_smtp_user_enumeration_tool_i_built_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/1ryrywt/smtpwn_an_smtp_user_enumeration_tool_i_built_for/)

How do I get started in cybersecurity?
https://www.reddit.com/r/Pentesting/comments/1ryxghm/how_do_i_get_started_in_cybersecurity/

<!-- SC_OFF -->Hi everyone, just to give a little context: I'm about to graduate with a degree in Computer Engineering (in approx. six months) and I'm figuring out my career path. Cybersecurity has always interested me, so I want to dive into it, but I'm not quite sure where to start. I already have a solid foundation in operating systems, networking, and software/hardware development, so I think the next step would be applying those concepts to security. From what I've seen on YouTube, the offensive side of security (pentesting) looks the most fun to me. Any suggestions on where I should begin? <!-- SC_ON --> submitted by /u/Tacei12 (https://www.reddit.com/user/Tacei12)
[link] (https://www.reddit.com/r/Pentesting/comments/1ryxghm/how_do_i_get_started_in_cybersecurity/) [comments] (https://www.reddit.com/r/Pentesting/comments/1ryxghm/how_do_i_get_started_in_cybersecurity/)