#web-security

Web Security Lab — Broken Brute-Force Protection, IP Block | PortSwigger Practitioner

My first attempt looked right on paper. I built a script, fed it to Intruder, hit start — and got the exact same “too many incorrect login…

SQL injection with filter bypass via XML encoding

This is a walkthrough of PortSwigger Lab: SQL injection with filter bypass via XML encoding.

PortSwigger Access Control Labs 4–6: What I Learned From Breaking Broken Authorization

Introduction

Practical OWASP API Security Testing: Finding Broken Object Level Authorization (BOLA)

A practical approach to identifying object-level authorization weaknesses in modern APIs

Watching the User, the Web, and the Model Itself: Biometrics, Web Security, and Adversarial ML

Part 1: Behavioral Biometrics — Continuous Authentication

Seri 1 — OIDC Nedir?

Bir uygulamaya girerken gördüğümüz giriş ekranı oldukça basittir bilgilerimizi girip kayıt oluruz fakat bu küçük ekranın arkasında…

HTB Cyber Apocalypse 2026: Gatery (Web) Writeup

HTB Cyber Apocalypse 2026: Gatery (Web) Writeup By Maloy Roy Orko

From JWT Manipulation to Splunk Analysis Investigating a Multi Stage Web Application Compromise

“Attackers exploit vulnerabilities. Investigators connect evidence. Great security professionals understand both.”

Protect Your WordPress Login Page: A Simple but Critical Guide

WordPress is the most popular website builder in the world, powering more than four out of every ten websites. That makes it a huge target…

WordPress Security Keys and Salts: The Invisible Guardians of Your Website

Picture this: You wake up one morning, coffee in hand, ready to tackle your day. Soon after, you open your browser to check your WordPress…

How To Protect Your WordPress Website from Modern Security Threats

WordPress powers millions of websites worldwide, making it the most popular content management system (CMS) available today. Its popularity…

Webverse-Pro Bound

lab write-up

7 Security Mistakes Hidden in Everyday Code

The most dangerous vulnerabilities often begin as ordinary implementation shortcuts that quietly trust the wrong input, identity, or system…

Think HTTPS Makes Your Website Safe? Hackers Can Still Attack Without Warning.

In today’s digital-first world, businesses often assume that simply installing an SSL certificate makes their website completely secure…

Athena: Not from the Odyssey, but from TryHackMe | Blind Command Injection to Kernel Module…

Hello Everyone,

Understanding SQL Injection: Bypasses, UNION Attacks, and Remediation

A practical walkthrough of breaking vulnerable queries, mapping database schemas, and securing application code with prepared statements.

Session Hijacking & Injection

Not every security vulnerability requires advanced hacking skills.

Authentication vs Authorization: The Difference That Breaks Apps

Part 3 of the “Security Engineers Forget” series. They sound the same, they’re abbreviated the same, and confusing them leaves your data…

WordPress Security Alert: Why Updating Your Website Is More Important Than Ever

A practical security guide for WordPress users on updates, monitoring, and protecting websites from emerging threats.

Lab: SQL injection UNION attack, retrieving multiple values in a single column

Mastering SQL Injection: Beating the Single-Column Problem with UNION Attacks

The Bug Bounty Playbook: IDOR

Part 1 of the Bug Bounty Playbook series. 252 disclosed HackerOne reports analysed. Five recurring patterns. One testing framework you can…

Bot Protection in 2026: A Practical Guide

You block an IP, and the bot switches to a residential proxy. You add rate limiting, and bots distribute requests across thousands of…

IDOR & Bypass Techniques: A Practical Methodology for Security Testing

Subtitle:

The Wristband Problem

Web Frameworks: Code Review | TryHackMe Walkthrough (A Beginner’s Guide )

“Read web app source like an attacker: trace user input to dangerous sinks, triage with Semgrep.”

Jscrambler npm Package Compromised: Why It Matters

Imagine your most trusted security guard. This guard is not just a standard patrolman; they are an elite, specialized operative, hired to…

Beyond Recon: My Personal Methodology for Hunting High-Impact Vulnerabilities in 2026

introduction

How Streaming Giant DAZN Passed Its First PCI DSS 4.0.1 Audit

A single line of malicious JavaScript, deftly injected into a third-party script on your checkout page, can siphon off thousands of credit…

PCI DSS 6.4.3 & 11.6.1 Solutions Compared (2026)

In 2023, the average cost of a data breach surged to an all-time high of $4.45 million, with a staggering 82% of these breaches involving…

Writing a Bug Report That Actually Gets Paid

Hey friends! Nitin here 👋

Agentic AI and Web Security: The Visibility Problem

The security industry has spent two decades building systems that monitor. What it hasn’t built, not yet, are systems that can reliably…

Visible error-based SQL injection Lab

This is a walkthrough of PortSwigger Lab: Visible error-based SQL injection lab.

Lightning Web Security setting changes behavior of custom (non-published) attributes on…

The same code of LWC Html

How I Do Recon in 2026: No Subdomains, No Wordlists, Just the App

The place the bugs live is already open in your browser. Most hunters spend hours looking everywhere else.

Kitty | TryHackMe Walkthrough — A Beginner’s Guide

“Map? Where we are going, we don’t need maps.” — Room tagline

I let strangers run any code on the page. They still couldn’t delete the warning on it.

Originally published on LinkedIn.

How to Secure a Checkout Page for PCI DSS v4.0.1: CSP, SRI, and Script Inventory

PCI DSS v4.0.1 places specific obligations on payment page scripts, CSP headers, and script inventory management. Here’s what frontend…

What an AI-Native WAF Should Actually Do

A signature-based WAF caught maybe a third of forty AI-generated SQL injection variants — not because the rules were wrong, but because the…

Ministry of Health Malaysia’s Website Got Hacked??🚨

On 27th June 2026 around at 2:11 am, Malaysia’s Ministry of Health (MOH) official website was reportedly compromised. Visitors were greeted…

Why You Need a Browser-Based Web Proxy

Many internet users frequently face network restrictions at schools, offices, or on public Wi-Fi networks. When access to your favorite…

Top 7 Consent Management Platforms in 2026

A practical guide to the leading tools that help organizations manage user consent, and why verifying what happens next matters just as…

DVWA SQL Injection

Difficulty Levels Covered: Low | Medium | High Vulnerability Class: CWE-89 — Improper Neutralization of Special Elements used in an SQL…

Mastering Command Injection: A Complete PortSwigger Web Security Academy Walkthrough for Bug Bounty…

From simple OS command injection to blind, out-of-band, and data-exfiltration techniques — a hands-on journey through all five PortSwigger…

Web-RTA Exam Review — What to Expect and How to Pass

From Manual To Agentic: The Pentesting Evolution Explained

For most of its history, penetration testing has been a craft. At the outset, a skilled human studied an application, formed a hypothesis…

SSRF Explained Like You Are Five (For Bug Bounty Beginners)

One of the highest paying bugs, finally explained in plain words.

Username enumeration via subtly different responses

This lab is vulnerable to username enumeration and password brute-force attacks. It has an account with a predictable username and…

The Problem With Signature-Based WAFs (And How We’re Solving It Differently)

Traditional WAFs are useful, but many still depend heavily on rules, signatures, and constant tuning. GladiosWAF takes a different approach…

The Payment Page That Passed Your Last Audit Isn’t the One Running Now

Beyond PCI DSS compliance: what an expert panel had to say about the accountability gap no framework alone can close, and why passing your…

When the main app is clean, go count the URL fetchers

There’s a trap in testing a polished product. You hammer the core flows, the auth is tight, the obvious injection points are all handled…