$256 Bounty : XSS via Web Cache Poisoning in Discourse
How Injecting Headers and Poisoning Cache Led to Stored Cross-Site Scripting
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/256-bounty-xss-via-web-cache-poisoning-in-d … ⌘ Read more
The Human Firewall: Why Your Employees Are Both Your Greatest Vulnerability and Asset
In the high-stakes world of cybersecurity, organizations invest millions in sophisticated technologic … ⌘ Read more
DCShadow Attacks: Subverting Active Directory Replication for Stealthy Persistence
Technique that allows adversaries to manipulate directory data by simulating the behavior of a legitimate Doma … ⌘ Read more
Part 1: How to Become a Pentester in 2025: Free & Affordable Online Labs ⌘ Read more
Logic Flaw: Using Invitation Function to Block Other Accounts ⌘ Read more
Bug Chain: pre-auth takeover to permanent access. ⌘ Read more
How I was able to delete a production backend server in my first finding. ⌘ Read more
Business logic: I can order anything from your account without paying for it ⌘ Read more
OSINT Writeups — MIST Cyber Drill 2025 ⌘ Read more
** How Hackers Bypass Login Pages with SQL, Logic Flaws, and Headers **
Welcome to the underworld of cybersecurity! 🌐 In this blog, we dive deep into how hackers bypass login pages — the digital gatekeepers of…
[Continue rea … ⌘ Read more
SameSite? SameMess: How I Bypassed Cookie Protections to Hijack Sessions ️♂️
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/samesi … ⌘ Read more
↳
In-reply-to
»
that site of mine i mentioned earlier? well it's now statically generated with astro, AND it automatically builds and deploys after i push changes to my own git instance, with the power of sourcehut builds! this is so cool
⤋ Read More
@kat@yarn.girlonthemoon.xyz i’m so obsessed like now i actually wanna play with the site more https://bytes.4-walls.net/kat/eunoia-astro
Master CRLF Injection: The Underrated Bug with Dangerous Potential
Learn how attackers exploit CRLF Injection to manipulate HTTP responses, hijack headers and unlock hidden vulnerabilities in modern web…
[Continue rea … ⌘ Read more
My cow is 2.3kg at 4 years old. ⌘ Read more
谷歌 Agent2Agent 協議原理解讀
谷歌在 25 年 4 月初發布了 A2A 協議，作爲 MCP 協議的補充。Agent2Agent 協議致力於促進獨立 agent 間的通信，幫助不同生態系統的 agent 溝通和協作。核心概念Agent Card：一個公共元數據文件（通常位於 /.well-known/agent.json），用於描述 Agent 的能力、技能、端點 URL 以及認證要求。客戶端通過它來發現 Agent。 Agen ⌘ Read more
Compress-a-thon — CSP Bypass via Redirection — Pentathon 2025
Compress-a-thon is a “web exploitation” challenge that was featured in Pentathon 2025 Finale Jeopardy CTF Round. This challenge involved…
[Continue reading on InfoSec Write-ups »](https://inf … ⌘ Read more
SSRF via PDF Generator? Yes, and It Led to EC2 Metadata Access
👨💻Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ssrf-via-pdf-generator-yes-and-it-led-to-ec2-metadata-access-39b8e5b41840 … ⌘ Read more
Shadow Credentials in Active Directory: When the Exploit Doesn’t Work — Until It Does ⌘ Read more
**The Hidden Language: Exploiting GraphQL for Unauthorized Data Dump **
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-hidden-language-exploiting-graphql-for-unauthorized-data-dump-8 … ⌘ Read more
Bug Hunting in JS Files: Tricks, Tools, and Real-World POCs
✅Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bug-hunting-in-js-files-tricks-tools-and-real-world-pocs-b4d43dd41d8e?source=rss—-7 … ⌘ Read more
Bug Bounty Race: Exploiting Race Conditions for Infinite Discounts ⌘ Read more
**Top 5 Easiest Bugs for Beginners in Bug Bounty **
Top 5 Easiest Bugs for Beginners in Bug Bounty 🐞
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/top-5-easiest-bugs-for-beginners-in-bug-bounty-45dd81c49e03?source=rss—-7b722bfd1b8d- … ⌘ Read more
$10,000 Bounty: HackerOne Report Comments Leak via “Export as .zip”
How a new export feature unintentionally exposed private discussions in limited disclosure reports
[Continue reading on InfoSec Write-ups »](https://infose … ⌘ Read more
Understanding Stealer Logs and Their Role in Security Testing: A Focus on Asset Discovery- Part 2 ⌘ Read more
Understanding Stealer Logs and Their Role in Security Testing — Part 1 ⌘ Read more
API Key Exposure in NASA GitHub Repository Leads to Unauthorized Access to Academic Data
🔓Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteu … ⌘ Read more
Subdomain Takeover: My $450 Win & How You Can Do It Too
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/subdomain-takeover-my-450-win-how-you-can-do-it-too-3337ca0513b6?source=rss—-7b722 … ⌘ Read more
How I Found SSTI in a Search Bar ⌘ Read more
How Backups Can Break End-to-End Encryption (E2EE) ⌘ Read more
Hidden HackerOne & Bugcrowd Programs: How to Get Private Invites
“Private programs are where the real gold lies… but no one tells you how to get there. Let me break it down for you — with secrets most…
[Continue reading on In … ⌘ Read more
↳
In-reply-to
»
⤋ Read More
tar and find were written by the devil to make sysadmins even more miserable
@kat@yarn.girlonthemoon.xyz my terrible script https://bytes.4-walls.net/kat/dotfiles/src/branch/main/scripts/Scripts/tinypin-log.sh
** CSP? More Like Can’t Stop Payloads — Bypassing CSP to XSS Like a Pro**
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/csp-more-like-cant-stop-payloads-bypassing-csp-to-xss-like-a-pro-9 … ⌘ Read more
playing a bit of guitar this morning
https://freetar.4-walls.net/tab/fifty-fifty/cupid-twin-version-chords-4667768?no_redirect
https://freetar.4-walls.net/tab/chappell-roan/good-luck-babe-chords-5191149?no_redirect
Tackling Conditional Blind SQLi Like a Pro: OSWE Prep Powered by Burp Suite ⌘ Read more
Ça y est ! Nicolas, 35 ans, achète une maison !
Un article à 4 mains écrit par h16 & Citronne Enfin ! Après moults péripéties, d’incessants allers-retours pour des visites et des discussions sans fin avec sa femme autour des “points non-négociables”, Nicolas, 35 ans, marié, et père de deux enfants (de 5 et 8 ans) a enfin trouvé la maison idéale pour la petite famille. […] ⌘ Read more
UUIDs: A False Sense Of Security
Hi Hunters, would you like to learn about a broken access control vulnerability that I discovered recently for a client.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/uuids-a-false-sense-of-security-10467497daae?source=rss—-7b7 … ⌘ Read more
$50,000 Bounty: GitHub Access Token
How a hidden token in a desktop app could have compromised one of the world’s biggest e-commerce platforms
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/50-000-bounty-github-access-token-c29cb6f00182?source=rss—-7b722bf … ⌘ Read more
️Recon Automation Like a Pro: My 5-Stage System to Catch More Bugs
✅Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8Frecon-automation-like-a-pro-my-5-sta … ⌘ Read more
Top 10 Ways Hackers Exploit Web Applications (and How to Prevent Them)
Hackers don’t wait for big websites. They look for easy mistakes. Let’s fix them before they find yours.
[Continue reading on InfoSec Write- … ⌘ Read more
Open Redirect Vulnerability: What It Is and Why It Matters ⌘ Read more
Wazuh: The Free SIEM That Fights Like a Paid One ⌘ Read more
HACK-ERA CTF — Phase 1 Walkthrough ⌘ Read more
$840 Bounty: How I Stole OAuth Tokens from Twitter
A critical OAuth misconfiguration allowed stealing tokens with just a click
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/840-bounty-how-i-stole-oauth-tokens-from-twitter-733f8 … ⌘ Read more
Plug, Boot, Vanish: How I Turned a USB Stick into a Portable Privacy Fortress ⌘ Read more
深入解讀 MCP 協議最新版本的 4 大升級【下】：批處理與增強的工具註解
本篇接着爲大家解讀 MCP 協議最新修訂版本（2025-03-26）的四個較大升級的後兩項（上篇翻閱：深入解讀 MCP 協議最新版本的 4 大升級【上】：傳輸機制與安全授權）：JSON-RPC 批處理 增強的工具註解 01JSON-RPC 批處理JSON-RPC 2.0 規範本身支持批量（Batch）模式，允許一次性發送一個包含多個請求對象的數組，服務器隨後可以返回 ⌘ Read more
Google requires Android applications on Google Play to support 16 KB page sizes
About a year ago, we talked about the fact that Android 15 became page size-agnostic, supporting both 4 KB and 16 KB page sizes. Google was already pushing developers to get their applications ready for 16 KB page sizes, which means recompiling for 16 KB alignment and testing on a 16 KB version of an Android device or simulator. Google is taking the next step now, requiring … ⌘ Read more