PinnedL4ZZ3RJ0D·Oct 11Recreating the DeepSeek Database Leak Wiz Research FoundBack in January 2025, Wiz Research found a completely open, unauthenticated ClickHouse database sitting on the public internet, tied…A response icon1A response icon1
PinnedL4ZZ3RJ0D·Jul 25The Brochure (THM) WalkthroughBefore booking anywhere, you do your homework, right? Reviews, photos, the usual. This room takes that completely normal instinct and turns…A response icon2A response icon2
PinnedL4ZZ3RJ0D·Jul 19Athena CTF — My OSINT JourneyPlayed Athena CTF and mostly stuck to OSINT, since that’s where I actually enjoy myself. There were five OSINT challenges total, but I’m…
PinnedL4ZZ3RJ0D·Jul 6No Hack No CTF — OSINT JourneyOnly managed two challenges before this one wrapped up, but two solid ones beat zero, so here we go.A response icon1A response icon1
L4ZZ3RJ0D·5h agoThe Internal Tool T-Mobile Forgot Was Facing the Public InternetBack to API security, and this one’s worth teaching specifically because the vulnerability class is almost embarrassingly simple compared…
L4ZZ3RJ0D·4d agoHow a Login Token for a Forum Became a Login Token for OpenAI’s Internal CodeBack to AI for this round, and this one’s barely two months old at time of writing, which is rare for this series but worth making an…A response icon1A response icon1
L4ZZ3RJ0D·6d agoHow Egor Homakov Generated Free Money on Starbucks Gift CardsClosing out this first round with the one almost everyone in the industry ends up learning about eventually, usually secondhand, rarely…
L4ZZ3RJ0D·Nov 8How Peloton Confused Authentication with AuthorizationMoving into API security for this one, and it’s a genuinely great teaching case because the company involved got the fix wrong not once but…
L4ZZ3RJ0D·Nov 7How a Guessable Number Exposed Every Meta AI User’s Private PromptsStarting the AI side of this series with one that genuinely deserves the spotlight. Found by Sandeep Hodkasia, founder of AppSecure…
L4ZZ3RJ0D·Nov 6How Four Lines of Code Could Delete Any Facebook Photo AlbumReal one again, and this time it’s about as clean a textbook IDOR as you’ll ever find written up, which is exactly why it’s worth actually…
