In the previous post, we focused on the passive side of post-exploitation: understanding where we landed, who we are, and what secrets the…

Web servers are the front door of the internet.
 Every website, API, cloud app, or SaaS platform depends on a web server — and that makes…

Selain web pentest, mempelajari pentest pada lingkungan android akan meningkatkan chance keberhasilan dalam dunia bug bounty. Tentu semakin…

A real-world data leak found 7y ago

Every 39 seconds, a cyberattack hits someone, somewhere. In a world where our personal data, finances, and even critical infrastructure…

This is my writeup for ‘It’s a trap!’, Malware Traffic Analysis

Government data leaks are often reported in headlines, but the mechanics behind how exposed information circulates online are rarely…

During a recent authorized security assessment of a mid-sized e-commerce platform, I identified a Remote Code Execution (RCE) vulnerability…

Denoscription

Denoscription

JavaScript analysis leads to personal information disclosure for a bank.

Hi Everyone, qarGI again. Today’s CTF is Soupedecode 01 Windows server. Let’s explore together…

Scenerio
The unthinkable has happened — McSkidy has been kidnapped. Without her, Wareville’s defenses are faltering, and Christmas itself…

Un commentaire ou une illusion ?

When I test a web application as a penetration tester, authentication is always a critical target. If authentication can be bypassed…

ARP spoofing & Man In The Middle Attacks Execution & Detection

Friend link if you aren’t a member

Karşımızda “JPChat” adında bir servis var. Genellikle 80 veya 443 portlarında çalışan web sitelerine alışığız ama bu sefer durum farklı. Bu…

Find all ASN + IPv4 + IPv6 address of your target

Hello Everyone !…. It’s been quite a while since I last published a write-up here…. life, work, and a lot of startup work happened in…