2d ago · 8 min read · TL;DR: Got an MCP OAuth proxy to hand me real production access tokens for any user who clicked one link. No fake login page. No cert warning. No MFA bypass. The victim actually signs in at the real S
Join discussion
3d ago · 6 min read · Originally published on satyamrastogi.com 3 million FTP servers operating without encryption expose credentials and sensitive data to network interception. Red teams exploit plaintext protocols for initial access and lateral movement in enterprise e...
Join discussion
Apr 16 · 5 min read · After 6 or 7 years on Hack The Box, competing, failing, learning, and coming back again, I finally reached the Top 7 worldwide. The number itself is not what matters most, but everything behind it: ti
Join discussion
Apr 14 · 8 min read · Originally published on satyamrastogi.com Basic-Fit's 1M member breach reveals systemic weaknesses in SaaS membership platforms. Attack likely leveraged credential compromise or API exploitation targeting customer databases without proper segmentati...
Join discussion
Apr 13 · 7 min read · Originally published on satyamrastogi.com Analysis of PlugX RAT distribution through counterfeit Claude website. Exploitation chain combines DLL sideloading with supply chain targeting. Attack methodology, detection evasion, and hardening strategies...
Join discussion
Apr 12 · 4 min read · It started with a mistake that cost attention. My own credentials were exposed. Not because of some advanced breach. Not because of malware. Just a simple developer mistake — a secret that should neve
Join discussion
Apr 12 · 3 min read · Let me be honest with you from the start — I am not writing this as an expert. I have no job yet. I am sitting at home, still waiting on companies to call me for onboarding after passing their intervi
Join discussion
