📰 Medium · Programming

The three exploitation primitives that turn a simple bug into complete control over a system. Continue reading on Medium »

A honeypot is a decoy system designed to look like a legitimate target. Continue reading on Medium »

A PhD researcher’s field notes on the strangest engineering requirement in finance: privacy and transparency, both, at the same time… Continue reading on Medium

GitHub recently paid $100,000 bug bounty for discovering a critical vulnerability in GitHub’s internal Git infrastructure. The reason lies… Continue reading on

HTTPS protects data in transit — but is it enough? In many enterprise systems such as banking, healthcare, fintech, and government… Continue reading on Medium »

Cracking Authentication Like a Pro Continue reading on Medium »

A field report from the war between automotive telemetry and the people who pay for the gas. Continue reading on Medium »

Six months into building the ERP I received an email from a security consultant we had hired to review the system before a large client… Continue reading on Med

While looking through Okta Verify 6.11.1 for Windows, I came across a tamper-protection implementation that did not appear to be doing… Continue reading on Medi

The most dangerous vulnerabilities often begin as ordinary implementation shortcuts that quietly trust the wrong input, identity, or… Continue reading on Skill

Gobuster is a fast command line tool used in cybersecurity to discover hidden files folders subdomains and web directories on a target… Continue reading on Medi

Short answer: Yes! So you can stop reading now. Continue reading on Medium »

Understanding conditions, jumps, and loops through an office maze with analytical malware defense prospective Continue reading on Medium »

Anyone who has read raw access logs on a public server has seen it: requests to /wp-login.php on a site that runs no WordPress, login… Continue reading on Mediu

Learn reconnaissance, brute forcing, command execution, CSRF, SQL injection, XSS, command injection, file upload exploitation, file… Continue reading on Medium

Cyber attacks are becoming more advanced every year, and no website is too small to become a target. Whether you run a personal blog, an… Continue reading on Me

Learn how BitLocker protects your files, how it works, and why simply having a Windows password is not enough. Continue reading on Medium »

Chrome just got another security update, and if you’ve been following the release notes, the pattern is getting pretty familiar. Out of 27… Continue reading on

CORS blocks your frontend. Tokens expire. @PreAuthorize can’t check what it hasn’t fetched yet. Here’s the complete fix. — Part 14 of Feel… Continue reading on

Picture a forged repair note slipped into a building’s work-order system. The contractor on call trusts the system, reads the note as an… Continue reading on Me

Zero secrets in config. Zero secrets in Key Vault references. Zero 3 AM “who rotated the password” incidents. Here’s the migration. Continue reading on Medium »

A year ago, the workflow was simple: a human wrote the code, and a security team checked it — on their schedule. Continue reading on Medium »

Every time your code makes a request, it carries your IP address along for the ride. The server sees that IP and decides what to do with… Continue reading on MS

Many websites and apps use databases to store information such as usernames, passwords, customer details, and orders. SQL Injection is a… Continue reading on Me