How an unprotected API endpoint allowed complete removal of Two-Factor Authentication using a desynchronized state.

When Logout Isn’t Really Goodbye: A Subtle Data Exposure Bug. How a “low severity” simple P4 bug still managed to teach a high-value lesson (and yes… it paid 💰). Beginner …

Hi, my name is Rangga.

I used to think hacking was about finding something… impressive.

Break authentication, control sessions, and own the API

Hi everyone, I found a simple vulnerability through fuzzing.

Hey folks, I am back with a new writeup. This one is about how I found a Broken Access Control issue on a WHO subdomain using Google…

From Foothold to Full Control: Exploiting Copy-Fail (CVE-2026-31431) for Instant Root Access

Challenge Description

This write-up is based on a training scenario from LetsDefend and is shared for educational purposes only.

Responsible disclosure, a DOM-Based XSS on an authentication domain, and a certificate signed by the security team. This is the story…

In modern offensive security, the objective is not just exploitation—it’s controlled impact, stealth, and precision.