PortSwigger Lab: Unprotected Admin Functionality — Solution

Before diving directly into the lab, let’s first understand the basics of Access Control.Continue reading on Medium »
Read more...

One Key, Two Meanings: JWT Algorithm Confusion in OopsSec Store

A public key you were meant to trust becomes the secret that betrays youContinue reading on Medium »
Read more...

Hello Hackers — Linux Luminarium Part 1
https://medium.com/@may.hack/linux-luminarium-hello-hackers-461253e396a7?source=rss------bug_bounty-5

IntroductionContinue reading on Medium » (https://medium.com/@may.hack/linux-luminarium-hello-hackers-461253e396a7?source=rss------bug_bounty-5)

Exploiting Race Condition to Break Idempotency & Corrupt Data Integrity
https://medium.com/@coolorangee3/exploiting-race-condition-to-break-idempotency-corrupt-data-integrity-160cbf0d2b71?source=rss------bug_bounty-5

Hello hackers! I’m back with another writeup. This time, I want to share a recent finding from a HackerOne program (jobs.target.com).Continue reading on Medium » (https://medium.com/@coolorangee3/exploiting-race-condition-to-break-idempotency-corrupt-data-integrity-160cbf0d2b71?source=rss------bug_bounty-5)

Pondering Paths — Linux Luminarium Part 2
https://medium.com/@may.hack/pondering-paths-linux-luminarium-part-2-56236746706c?source=rss------bug_bounty-5

Part 1 is already available on my profile. Check my profile if you haven’t read it yet.Continue reading on Medium » (https://medium.com/@may.hack/pondering-paths-linux-luminarium-part-2-56236746706c?source=rss------bug_bounty-5)

Security Week: Gitea RCE Under Attack, Critical Web Flaws, and Tag-Name XSS

Five urgent CVEs, three fresh web security research stories, and the bug bounty lessons defenders should carry into next week.Continue reading on InfoSec Write-ups »
Read more...

Security Week: Gitea RCE Under Attack, Critical Web Flaws, and Tag-Name XSS
https://infosecwriteups.com/security-week-gitea-rce-under-attack-critical-web-flaws-and-tag-name-xss-6db2611da923?source=rss------bug_bounty-5

Five urgent CVEs, three fresh web security research stories, and the bug bounty lessons defenders should carry into next week.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/security-week-gitea-rce-under-attack-critical-web-flaws-and-tag-name-xss-6db2611da923?source=rss------bug_bounty-5)

agentZ
https://kitploit.com/en/tools/github/accuknox/agentz

Zero-trust agentic AI platform. Supports SaaS and OnPrem (airgapped) deployments.

FuzzingBrain-Bench
https://kitploit.com/en/tools/github/fuzzingbrain/fuzzingbrain-bench

A sealed benchmark for LLM-driven bug discovery: 77 challenges across 43 open-source projects (C/C++/Java). Each challenge is an answer-free Docker image with in-image grading — no patch, Poc or answer key ships.

CVE-2014-085
https://kitploit.com/en/tools/github/ehaoxiongdiycw/cve-2014-085

Nuclei template and PoC for exploiting ZooKeeper unauthorized access vulnerability (CVE-2014-085), enabling automated security testing against target IPs.

WSGoat
https://kitploit.com/en/tools/github/makarov05bm/wsgoat

The vulnerable application that will teach you how to hack WebSockets

nl-kat-coordination
https://kitploit.com/en/tools/github/ssc-ict-innovatie/nl-kat-coordination

Modular network scanning framework that integrates diverse tools and external databases to detect vulnerabilities and configuration errors, producing accessible reports for continuous security monitoring.

OWASP-Top-10-AI-Infrastructure-Security-Risks
https://kitploit.com/en/tools/github/owasp/owasp-top-10-ai-infrastructure-security-risks

A practical framework identifying and prioritizing the top security risks in AI datacenter infrastructure, covering hardware, networking, management planes, and supply chain, with mitigation strategies for providers and customers.