Butrint Komoni·1d agoBMW Group Security Hall of Fame 2026: A Few Thoughts on Bug Bounty StrategyButrint Komoni (@pwntheplanet)
A. M. Alogo Situmorang·1d agoWhat the UI Hides, the API Tells: How I Found Mass Data Exposure in a Live Chat FeatureChaining guest JWT tokens, missing rate limits, and verbose JSON responses to land my second bug bounty reward.
Piyusha Akash·1d agoHunting Call-Preceded Gadgets for Call Stack Spoofing Research on WindowsA step-by-step walkthrough from zero to a verified, clean trampoline gadget
Chidubem Chukwu·2d agoWhen AI Memorizes Instead of Learning: Understanding Overfitting Through an AI Red Teaming LensArtificial intelligence is changing how we approach cybersecurity. From detecting malicious activity to analyzing suspicious network…A response icon1A response icon1
Vigneshkumaroffsec·3d agoWhy Rate Limiting Fails Against Distributed Attacks — and How to Build One That HoldsYou added a rate limit to your login and the brute-force didn’t stop. Here’s why per-IP limits break against rotating IPs, how to detect…
Abdelkader ELazizze·3d agoEmulating Nation-State Tradecraft: The Modern APT PlaybookReplicating the exact delivery and execution chains of APT29 and SideCopy. A practical guide to HTML Smuggling, ISO MOTW bypasses, and…
Daniel Dobrenz·3d agoRed Teaming a Mock Hospital AppI wanted to recreate my last NuGuard red teaming project into a Jupyter Lab based environment that targets a realistic mock hospital…
Razzle Mouse 🐭·3d agoHack Smarter: Millennium WriteupPlatform: HackSmarter | Difficulty: Medium | Category: Active Directory | Objectives: KRBTGT hash
Vigneshkumaroffsec·4d agoDependency Confusion Explained: How a Missing NPM Package Becomes Remote Code ExecutionHow a package name your build already trusts gets claimed by someone else, how I found one in a bug bounty, and the registry settings that…
