AYAayush Yadavinaayushyadav.hashnode.dev·21h ago · 26 min readWhere the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT PipelineEvery VAPT report ends the same way: a handful of numbers. A CVSS score. A severity label. A priority rank. Sometimes an aggregate risk score. Those are the numbers a remediation team actually acts on10
SSpecsinspecswrites.hashnode.dev·3d ago · 32 min readThe Tunnel Is Safe, Not The Destination: HTTPS Demystified The Illusion of Safety Connection is secure. A padlock. The "S" in HTTPS. For decades, these have been signals we trust when browsing the web. I trusted them too, but I never stopped to ask what was a10
MM1Hinm1h.hashnode.dev·6d ago · 5 min readBreached Credentials Lead to Admin Account Compromise via stored XSSObjective: Health Smarter is releasing a new portal for patients and employees to manage appointments and healthcare data. You have been hired to perform a full web application penetration test agains10
ZZeroProtocolinwebpentestingdeepdive.hashnode.dev·Aug 15 · 6 min readEncoding in Web ApplicationsWeb applications move data constantly—through URLs, form fields, cookies, headers, and API payloads. The catch: many transport mechanisms (especially URLs and HTML) are text-oriented, while real input11Z
VCVictor Chukwuemeka Onwuegbuchuleminvictor-chukwuemeka.hashnode.dev·Aug 14 · 18 min readTLS and Certificates: How Two Strangers Agree on a Secret, and Why Your Browser Trusts AnyoneLast post ended with a promise. We had explained that HTTPS is ordinary HTTP running inside an encrypted tunnel called TLS, Transport Layer Security, and that this tunnel provides confidentiality, int00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 13 min readTryHackMe : Dreaming WriteupSummary Dreaming is a Linux box built around a Pluck CMS install. Brute-forcing the CMS admin login gives access to the admin panel, which is then abused via a known authenticated file-upload RCE (CVE11N
YPYogeshwar Peelainexploitnotes.hashnode.dev·Aug 10 · 15 min readTryHackMe : WhyHackMe writeupSummary WhyHackMe is an medium Linux box that chains a handful of low-friction bugs into root. Anonymous FTP leaks a hint pointing at a pass.txt file that's only reachable from localhost. The blog app10
VCVictor Chukwuemeka Onwuegbuchuleminvictor-chukwuemeka.hashnode.dev·Aug 8 · 18 min readHTTP and HTTPS: The Language of the Web, and the S That Protects ItWe have climbed a long way up the stack. We gave data a network to travel on, a way to travel in packets, an address to aim for, a name that resolves to that address, and in the last post, a reliable 00
DSDoogal Simpsonindoogal.dev·Aug 2 · 5 min readHow to Prevent SQL Injection with Parameterized QueriesQuick Answer: SQL injection attacks exploit vulnerabilities in how web applications construct database queries. By sending malicious SQL code through user input fields (like search bars), attackers ca00
Ddamienanon14ininfinitedomain.hashnode.dev·Jul 26 · 4 min readMy First SQL InjectionI've been building up to this one for a while. Out of everything I've worked through in the lab so far, SQL injection is the attack that actually made cybersecurity feel real to me, not because it's f00
