MKMohit Kumarinmohitkumar1.hashnode.dev·1h ago · 8 min readYour AI Agent Has Too Much Power -Auditing Excessive AgencyAuthor: Mohit KumarProject: Bulwark – An open-source security stack for AI agentsGitHub: mk12002/Bulwark This article is part of the Bulwark series, where I explore practical approaches to securing AI00
YPYogeshwar Peelainexploitnotes.hashnode.dev·3d ago · 5 min readTryHackMe : The Hollow ShellOverview The Hollow Shell is a Flask app ("Shoreline Display - Room Service") that lets an authenticated concierge upload themed "shells" as .zip archives. Each archive must contain a shell.json manif10
YPYogeshwar Peelainexploitnotes.hashnode.dev·5d ago · 6 min readTryHackMe : Towel on the Sunbed WriteupTL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th10
MNMilan Nikicinsecuritydepth.hashnode.dev·5d ago · 20 min readServer Side Request Forgery in Java and Spring: Secure Coding PatternsServer Side Request Forgery, commonly abbreviated as SSRF, ranks among those vulnerabilities that look trivial during code review but escalate into full-blown incidents once they hit production. The c00
YPYogeshwar Peelainexploitnotes.hashnode.dev·6d ago · 7 min readTryHackMe : Beach Bar WriteupTL;DR Beach Bar is a Flask-based "DJ booth" web app for a beach bar jukebox. Default demo credentials (dj/dj) left enabled in an HTML comment get you into the dashboard, which exposes a YAML playlist 10
SSSunny Sainiinvillxn.hashnode.dev·Aug 3 · 20 min readChapter 1 — The Language of the WebGreetings, Future Operators! ✌️ Welcome to "The Operator's Playbook", a long-term series where we'll explore the world of Offensive Security from the ground up. Throughout this journey, we'll cover a00
AAAhmed Awad ( NullC0d3 )innullc0d3.hashnode.dev·Aug 2 · 3 min readHunterX is Now Listed in the OWASP Community Vulnerability Scanning Tools CatalogOpen source development is full of milestones. Some are measured by downloads. Some by GitHub stars. Some by funding. And then there are milestones that mean something different. Today, HunterX reache00
VWVictor Wariboko-Westincybersage.hashnode.dev·Aug 1 · 5 min read7 Security Mistakes Junior Developers Make (And How to Fix Them)Security is not exactly taught in the same way syntax and frameworks are. Most junior developers learn it the hard way: after a bug is reported, a client sends an angry email or a 3 a.m Slack message 00
MNMilan Nikicinsecuritydepth.hashnode.dev·Jul 27 · 16 min readFile Upload Vulnerabilities: Security Architect's Perspective (Part 2)Part 1 covered the technical implementation of secure file upload handling in Java and Spring. It went through content validation with Apache Tika, path traversal defenses, generated filenames, image 00
SSunnyincybersecurity-learning.hashnode.dev·Jul 22 · 19 min readTryHackMe SQL Injection Beginner-Friendly Learning GuideIntroduction I recently completed the SQL Injection room on TryHackMe as part of my ongoing cybersecurity learning journey. SQL Injection is one of the most important web application security vulnerab00
