#web-application-security

TCH

DH Dharavathnagaraju

Blind XSS | TryHackMe CTF Walkthrough| by Dharavath Nagaraju

Blind XSS

Jul 05, 2026 · 3 min read · 0 claps #cybersecuirty #xss-vulnerability #blind-xss

TCH MDA MKT

CY CyberPodcast

CVE-2026–10087: Cross-Site Scripting in GitLab EE Analytics Dashboard

When analytics dashboards become a client-side execution surface

Jul 03, 2026 · 6 min read · 0 claps #gitlab #cve #xss-vulnerability

ECO

NA Natalia Trojanowska-Korepta · SecuRing

OpenID Connect Nonce explained: Where it matters and where it doesn’t. Replay attack revisited

The nonce is rarely implemented and often misunderstood. Take a closer look at the OIDC nonce, replay attacks, and whether the nonce…

Jun 16, 2026 · 8 min read · 0 claps #security #identity-management #web-application-security

SPT

AN ANXS3C

TwoMillion-Machine — writeup

From deobfuscating JS code to root ‘CVE-2023–0386’

Jun 12, 2026 · 6 min read · 1 claps #os-command-injection #web-application-security #penetration-testing

ART TCH

MO Moiz Lakdawala

Tuning your WAF without losing your mind: threat hunting and rule tweaks that cut the noise

Most WAFs ship loud and dumb. Here is the boring, iterative craft of making one useful: custom bot profiles, log hunting, surgical…

Jun 09, 2026 · 9 min read · 0 claps #cybersecurity #waf #web-application-security

TCH

CY Cybercodeami

How I cleared the GIAC Web Application Defender (GWEB) Certification

Last week I cleared the GWEB exam, and a lot of people asked me how I prepared. So here is my breakdown of how I studied for it and what…

Jun 08, 2026 · 5 min read · 0 claps #gweb #san #giac

TCH

SH Shubhomrawat

Beyond XSS and SQLi: Why Business Logic Is the Real Frontier of Web Security Testing

What a week of hands-on API testing taught me about thinking like an attacker, not just scanning like a tool

May 15, 2026 · 4 min read · 1 claps #owasp-api-security-top-10 #web-application-security #cybersecurity

TCH AI

SH Shikhali Jamalzade · InfoSec Write-ups

Web-RTA Exam Writeup — Passed | CyberWarFare Labs

Certification: Web-RTA (Web Red Team Analyst) Issued by: CyberWarFare Labs (CWL) Difficulty: Beginner–Intermediate Format: Practical…

May 12, 2026 · 7 min read · 205 claps #web-penetration-testing #web-application-security #cybersecurity

TCH SCI

RA Rathsara · MeetCyber

Moving From a Managed WAF to One We Actually Owned

A practical account of evaluating, proof-of-concepting, and migrating 100+ web assets to Imperva over four months, without taking down a…

May 11, 2026 · 8 min read · 0 claps #web-application-security #cybersecurity #web-application-firewall

AI

SH Shikhali Jamalzade · InfoSec Write-ups

CRTA Exam Writeup — Passed | CyberWarFare Labs

Certification: CRTA (Certified Red Team Analyst) Issued by: CyberWarFare Labs (CWL) Difficulty: Intermediate Format: Practical…

May 11, 2026 · 6 min read · 202 claps #cyberwarfare-labs #ctf-writeup #penetration-testing

TCH

0B 0ber1n

WebVerse Pro Stole My Night (And I’m Not Mad)

[Introduction]

May 10, 2026 · 4 min read · 1 claps #web-application-security #hacking #pentesting

TCH

KI Kishor K.

SQL Injection Deep Dive: From Beginner to Full Exploitation

The login page looked ordinary.

May 08, 2026 · 8 min read · 0 claps #sql-injection #cybersecurity-training #cybersecurity-awareness

TCH

NI Ninascott

Java Development Company for Secure Web Application Development

Building a web application is no longer just about features and functionality. Security has become one of the most important parts of…

May 06, 2026 · 3 min read · 0 claps #java-development-company #web-application-security #java-development

TCH HUM

AP Application Security Master

Web Application Security: Prevent Attacks and Data Breach

Web Application Security is the practice of protecting websites and online services from cyber threats and unauthorized access. It ensures…

Apr 14, 2026 · 6 min read · 0 claps #web-application-security #application-security #cyber-security-training

0X 0xF3r4t

Bug Bounty Journey — Valid Report Part 11

In this journey, I will share my experience with a valid report I submitted. This will be a series until I discover new vulnerabilities. 😊…

Apr 06, 2026 · 2 min read · 4 claps #bug-bounty #intigriti #improper-access-control

SPT TCH

AN ANXS3C

OS Command Injection Vulnerability

OS Command Vulnerability ?

Mar 28, 2026 · 6 min read · 1 claps #os-command-injection #penetration-testing #web-application-security

TCH

DH Dhruv

🔰 Nuclei Cheat Sheet (Basic → Advanced)

Nuclei is developed by ProjectDiscovery and works best when combined with recon tools like Subfinder, Httpx, Naabu and testing tools like…

Mar 23, 2026 · 2 min read · 5 claps #nucleus #bug-bounty #bug-bounty-tips

TCH AI

0B 0ber1n

SANS 542 and GWAPT..Worth?

The GIAC Worth Scale (Thanks Gemini)

Mar 20, 2026 · 2 min read · 5 claps #san #gwapt #cybersecurity

TCH HUM

AD Aditya Kumar

Web Application Security: Hands-On Practice (Chapter 15 from The Web Application Hacker’s Handbook)

Note: This write-up reflects my learning and hands-on practice based on the book The Web Application Hacker’s Handbook: Discovering and…

Mar 10, 2026 · 5 min read · 0 claps #chapter-15 #web-application-security #cybersecurity

SPT

SA Sanskriti

A brief about SSL/TLS, TCP and UDP

Imagine typing a website address into your browser and instantly receiving a fully loaded webpage. Within seconds, your request travels…

Mar 08, 2026 · 8 min read · 1 claps #tcp-udp #ssltls #web-application-security

TCH

KU Kunal Arora

Web Application Security: Protecting Modern Digital Platforms

Introduction

Feb 18, 2026 · 1 min read · 0 claps #cybersecurity-online #ethical-hacking-online #web-development

TCH SOC HUM

UD Ud4y

IDOR Vulnerabilities Explained: A Researcher’s Guide to Authorization Flaws

Insecure Direct Object References (IDOR) remains one of the most prevalent web application vulnerabilities, despite being technically…

Feb 17, 2026 · 7 min read · 1 claps #web-application-security #bug-bounty #idor-vulnerability

TCH HUM

AD Aditya Kumar

Web Application Security: Hands-On Practice (Chapter 11 from The Web Application Hacker’s Handbook)

Note: This write-up reflects my learning and hands-on practice based on the book The Web Application Hacker’s Handbook: Discovering and…

Feb 13, 2026 · 7 min read · 2 claps #chapter-11 #web-application-security #cybersecurity

TCH

AL ALESSANDRO FARREL GERRARD WIJAYA

How OWASP Guides Web Application Security Testing and Methodology

A Beginner’s Guide to Web Application Security Testing with OWASP

Feb 09, 2026 · 7 min read · 0 claps #owasp #web-application-security #wstg

TCH LIF

0B 0ber1n

Shot of SQL at the Cafe Club — BugForge Daily

Welcome to the Cafe Club, where the coffee is roasted better than the security is implemented! BugForge.io brought back this classic…

Jan 12, 2026 · 3 min read · 2 claps #hacking #ethical-hacking #web-application-security

TCH

0B 0ber1n

A Furry SQLi with BugForge

*** EDIT: Came back to add an easier flag approach that fixes some of the crazy behaviors I saw. Adding to the end of everything***

Jan 11, 2026 · 8 min read · 3 claps #ethical-hacking #web-application-security #ctf-walkthrough

TCH

0B 0ber1n

Otters and GraphQL — Bugforge Daily

Heyoooo and welcome to another fun BugForge.io daily challenge. This one is going to be a bit different, as I’m still finding out what kind…

Jan 11, 2026 · 4 min read · 1 claps #hacking #web-application-security #ctf

TCH ECO

0B 0ber1n

JWT at Shady Oaks Financial — BugForge Daily Challenge

What’s up everyone and welcome back to another walk-through of an exciting BugForge.io daily challenge. This challenge is actually one of…

Jan 10, 2026 · 9 min read · 0 claps #hacking #ctf-writeup #web-application-security

TCH

0B 0ber1n

CopyPasta IDOR — BugForge Daily Challenge

What’s up everyone and welcome to the first ever walk-through! Is this going to be the best walk-through you’ve ever read? Probably not…

Jan 08, 2026 · 7 min read · 0 claps #hacking #idor-vulnerability #web-application-security

TCH LIF

PL Plexicus

Top 10 Aikido Security Alternatives for 2026: From Reducing Noise to Automated Fixes

Aikido Security became popular by cutting down on unnecessary alerts. By focusing on reachability, it helped developers avoid the…

Dec 24, 2025 · 6 min read · 0 claps #cybersecurity #security #information-security

TCH

AB Abdalla Sakr

Beyond the Firewall: Your Essential Introduction to Web Application Security Testing

The internet runs on web applications. And where there is complexity, there is vulnerability.

Oct 28, 2025 · 7 min read · 50 claps #ethical-hacking #information-security #web-application-security

TCH

OM Omer Bawazir

Hackviser  —  Insecure Direct Object References (IDOR) Labs

🧪 Hackviser — Web Application Security

Oct 20, 2025 · 7 min read · 52 claps #hackviser #idor #capt

TCH

OM Omer Bawazir

Hackviser — Unrestricted File Upload Labs

🧪 Hackviser — Web Application Security

Oct 10, 2025 · 5 min read · 105 claps #hackviser #web-application-security #unrestricted-file-upload

TCH MDA

SI Sinem Ulusoy

F5 BIG-IP AWAF ile Parametrelerde Base64 Korumasını Devreye Almak

Bu makalede, base64 ile kodlanmış parametrelerdeki korumaları nasıl devreye alabileceğimizden bahsedeceğiz.

Oct 07, 2025 · 5 min read · 50 claps #base64 #f5-big-ip #awaf

TCH MDA

AL A Learner

TryHackMe’s PT1: A 48-hour long (simulated) penetration testing experience

My experience of preparing and attempting the recent TryHackMe’s PT1 certification exam

Aug 31, 2025 · 10 min read · 0 claps #tryhackme #pt1 #penetration-testing

TCH

ON Onurcan Genç · System Weakness

eWPT Exam Guide: Strategies, Study Materials, and Final Takeaways

A complete guide to the eWPT exam: strategies, study resources, and lessons I learned from my own exam experience.

Aug 28, 2025 · 9 min read · 49 claps paywalled #cybersecurity #ewpt #penetration-testing

MI Mike (ClawHak)

Your Website’s Silent Guardians: A Deep Dive into Security Headers

Security headers are more than just a technical detail — they’re the silent guardians that protect your website and your users’ data from…

Aug 12, 2025 · 5 min read · 0 claps paywalled #bug-bounty #web-application-security #http-security-headers

TCH

GO Gourav(spidergk)

🎯 Hall of Fame: Open Redirect Vulnerability in Ericsson Job Portal

By Gourav Kumar

Jul 30, 2025 · 2 min read · 2 claps #bug-bounty #cybersecurity #web-application-security

TCH ECO SOC

UD Ud4y

Beyond Bugs: How Business Logic Flaws Put Apps at Risk

Imagine this: you’re shopping online, add something to your cart, skip the payment step using a browser trick, and still get the product…

Jul 17, 2025 · 3 min read · 0 claps #application-security #web-application-security #penetration-testing

TCH SOC HUM

GO Gourav(spidergk)

Inconsistent Session Logout After Enabling 2FA on Epic Games — A High-Impact Flaw Explained

Author: Gourav Kumar (@spider_gk)  Platform: EpicGames.com  Severity: High (CVSS 7.5)  Category: Insufficient Session Expiration  Status…

Jul 14, 2025 · 3 min read · 11 claps #bug-bounty #cybersecurity #two-factor-authentication

TCH

MA Madhumathi chamarthi

BWAPP Series : HTML Injection-High Severity Level

👋 Hello and Welcome…..

Jul 03, 2025 · 5 min read · 1 claps paywalled #bwapp #owasp #web-application-security

TCH

UD Ud4y

Understanding Authentication: What It Is, Why It Fails & How to Fix It

What is Authentication?

Jun 30, 2025 · 2 min read · 0 claps #web-application-security #penetration-testing #authentication

TCH

GL Glesec

Why Is Penetration Testing Important for Web Application Security Testing?

In today’s digital-first world, where businesses rely heavily on web-based platforms and cloud services, cybersecurity has become a…

Jun 16, 2025 · 2 min read · 0 claps #web-application-security

TCH

KH Khang Nguyen

OffSec Web Expert (OSWE) 2025 Review

Background

Jun 15, 2025 · 4 min read · 2 claps #oswe #offsec #cybersecurity

TCH

UD Ud4y

Understanding Host Header Attacks: How a Small Header Can Lead to Major Vulnerabilities

HTTP Host Header:

Jun 03, 2025 · 3 min read · 0 claps #web-application-security #cybersecurity #penetration-testing

TCH

MA Madhumathi chamarthi

BWAPP Series : HTML Injection-Low Severity Level

Hellllllloooooooooooooo…………🙋🏻‍♀️

Jun 03, 2025 · 3 min read · 0 claps paywalled #html-injection #bwapp #owasp-top-10

EN Enes Kaplan

Citrix Netscaler VPX İlk Yapılandırma/ Citrix Netscaler VPX Initial Configuration

1- İndirme ve ESX üzerine Dağıtım işlemi / Download and Deployment on ESX

Feb 17, 2025 · 3 min read · 2 claps #netscaler #vpx #citrix

TCH MDA

MI Michael Cooter

A Beginner’s Guide to Testing for Directory Traversal Attacks

In a few weeks, I’ll be taking the Offensive Security Web Assessor (OSWA) certification exam from Offensive Security. As part of my…

Jan 20, 2025 · 7 min read · 2 claps #directory-traversal #web-application-security #hacking

TCH

BR Brajesh Kumar

Comparative Analysis of Akamai WAF and Google Cloud Armor: Insights from Experience

A Comparative Analysis of Akamai WAF and Google Cloud Armor: Insights from Experience

Jan 11, 2025 · 4 min read · 14 claps paywalled #akamai #google-cloud-platform #google-cloud-armor

TCH

BR Brajesh Kumar

Why Leaving Unmonitored Subdomains on CDN is a Vulnerability

Leaving unmonitored subdomains on a Content Delivery Network (CDN) can lead to several security vulnerabilities, especially when…

Jan 11, 2025 · 4 min read · 2 claps paywalled #cybersecurity #cloud-security #network-security