#ethical-hacking

Understanding DOM and API-Driven Stored XSS in OWASP Juice Shop: A Beginner-Friendly Lab…

Cross-site scripting (XSS) is a web vulnerability that occurs when an application treats untrusted input as executable browser content. In…

Evading IDS, Firewalls, Honeypots

IDS (Intrusion Detection System), Adalah sistem deteksi gangguan yang mengawasi lalu lintas jaringan atau sistem untuk perilaku…

Shells Overview: Reverse Shells, Bind Shells, and Web Shells

Introduction

10 Cybersecurity Projects Every Student Can Build

Learning cybersecurity through courses and tutorials is useful, but practical projects can take your understanding much further.

Username Enumeration via Different Responses — PortSwigger

A lab walkthrough for username enumeration via different responses from port swigger lab

PortSwigger Access Control Labs 4–6: What I Learned From Breaking Broken Authorization

Introduction

Afore the Hack: Understanding Networking Fundamentals

While recently exploring Remote Code Execution (RCE), one of the more serious vulnerability classes in cybersecurity, I got to thinking…

Session Hijacking

If you work with systems that expose APIs — whether a classic web application or a backend serving an LLM agent — there’s a class of bugs…

The Data Lineage Trap: Can Your Organization Prove Where Every Critical Data Point Came From?

Introduction

Nothing Was Vulnerable……Until These 5 Things Were Connected

How attackers turn ordinary permissions, APIs, processes, and trust relationships into attack chains

Top Cybersecurity Trends in 2026: What Businesses and Individuals Must Know

Published by Verveox Technologies

onyiuwa anthony

Enumeration Task — Metasploitable 2

Name: Mariam Mohamed

IPv6 penetration testing.

Retrocompatibility is a vulnerability

I Spent Hours Fighting SSL Pinning — Then ChatGPT Changed Everything

It was late in the evening when I opened the Android application for the tenth time.

Web Cache Deception vs Web Cache Poisoning: The Attack Paths Most Hunters Confuse

Two bugs. Same word — “cache” — in both names. Completely different kill chains. And I’ve seen enough duplicate reports and “N/A, not a…

I Took Over Someone’s Subdomain and Put a Cat On It

Was poking around a wildcard scope, let’s call the target *.l4zz3rj0d.com for this one. Ran subzy against a pile of subdomains to check for…

The Uncensored AI Workforce: Automating Your Boring Tasks 24/7

Disclaimer: This guide is for educational purposes only. Ensure you have explicit, authorized permission before scanning or testing any…

How I Found and Claimed a Subdomain Takeover on cewe.kruidvat.nl

Subdomain takeovers are one of those vulnerabilities that sound simple in theory but pay well in practice — and I recently found one on a…

Day 20: YARA Rules — The Language of Malware Detection

As defenders, we analyze more than logs and network traffic.

Bug Bounty Journey — Day 0: The Commitment

Every major milestone starts with a simple, clear plan. Today marks Day 0 of my Bug Bounty journey. The ultimate target is to earn my first…

The OSI Model: How Each Layer Works, and Where Attackers Actually Hit It

Hey This is Saksham. When I started my cyber security journey, I didn’t even know how an Ethernet cable worked, what a switch ,router or…

Understanding the WordPress wp2shell Attack

Cybersecurity is constantly evolving, and attackers are always looking for new ways to exploit software vulnerabilities. One recent example…

Without hashing, the digital world would be an open door for cybercriminals.

Every time you log into a website, your password is never actually stored anywhere on the server, at least, not in the form you typed it…

Athena: Not from the Odyssey, but from TryHackMe | Blind Command Injection to Kernel Module…

Hello Everyone,

WordPress Security Alert: Why Updating Your Website Is More Important Than Ever

A practical security guide for WordPress users on updates, monitoring, and protecting websites from emerging threats.

OSINT CTF Walkthroughs

Osint Walkthroughs

Kali Linux vs Parrot OS: Which Hacking OS is Best in 2026?

Starting out in cybersecurity, you quickly realize that choosing your tools is just as important as choosing your learning path. The very…

COM Oversimplified: Understanding The Windows Technology Behind COM Hijacking, DCOM, and Modern…

Before we start, my apologies in advance. This is going to be a long one. Needed to really break this down as much as I can for y’all…

From Shell to Domain: Binary Exploitation, Network Pivoting, and Lateral Movement in a Single…

By Odai Mherat

Building a Cybersecurity Portfolio That Gets Interviews

How to turn labs, investigations, and small security projects into evidence that employers can trust

Managing Crypto Made Simple with Crypnio

The Rise of Modular Blockchains and AppChains in 2026: A Complete Investor Guide

I Chained Four Privilege Escalation Bugs to Root a Box — Here’s the Full Breakdown

Invalid Curve Attacks in ECC: Recovering Private Keys via the Chinese Remainder Theorem

Invalid curve attacks are one of the most devastating classes of attacks against elliptic curve cryptography systems. When implemented…

Nmap vs Masscan vs RustScan: Know Your Tools

Three tools. Three different jobs. Most people are using the wrong one for the wrong task.

Day 8: Sysmon Explained — Why Windows Event Logs Alone Aren’t Enough

In the previous article, we explored how Windows Event Logs provide valuable information for monitoring and investigating security events…

Window 7-Exploit Eternal Blue (MS17–010)

Introduction

Understanding URLs: Breaking Down Every Part of a Website Address

Introduction:

Tryhackme Walkthrough — Operation Endgame

#ActiveDirectory #DomainController #Bloodhound #ResourceBasedContrainedDelegation #GenericWriteExploit #TargetedKerberoasting #BloodyAD

Foreign Transaction Fees Explained: How They Work & How to Avoid Them

Definition

Zero Days: The Worm That Broke Iran’s Centrifuges Without Firing a Shot

How a piece of code the size of a photo file infiltrated one of the most guarded facilities on Earth — and rewrote the rules of war

Week 14: How the Internet Actually Moves Your Data — Routing, Switching, Firewalls & IDS/IPS…

You type google.com and hit Enter. In milliseconds, your request travels across the globe and comes back with a webpage. But how? And who’s…

Reconnaissance in 2026: The Art and Science of Cyber Intelligence Gathering

Subtitle:

From a Login Screen to Account Takeover: A Critical Security Assessment of a Leading Investment…

Responsible Disclosure

Beyond Recon: My Personal Methodology for Hunting High-Impact Vulnerabilities in 2026

introduction

What Is the Scope of Cybersecurity Jobs in Government?

If you aspire to build a stable, prestigious, and high-paying career, cybersecurity jobs in the government and defence sector offer…

How I Abused a Group Policy Object (GPO) in Active Directory (And How to Fix It)

Group Policy Objects (GPOs) are one of the most powerful features in Active Directory. They allow administrators to manage settings across…

How I Reset Another User’s Password Without Domain Admin (And How to Fix It)

One of the most common Active Directory misconfigurations is delegated permissions.

Investigating a Phishing Email Like a SOC Analyst — Part 3: Content Analysis

Modern phishing emails rarely rely on poor grammar or obvious mistakes anymore. Today’s attackers invest significant effort into designing…

Writing a Bug Report That Actually Gets Paid

Hey friends! Nitin here 👋