Ever wondered whether you ever missed a hidden subdomain that would have unlocked a critical vulnerability and a large bounty reward? In this article, you will discover how cutting-edge subdomain ...

Cross-Site Scripting (XSS) is a super-common vulnerability that infects a victim’s browser with malicious JavaScript code, which is then used to hijack the victim’s data or, in some cases, take ful...

This is a guide to performing white box penetration testing on a JavaScript web application running within a Docker container. In testing a web application vulnerable to prototype pollution, we wil...

This article explains how to perform white-box penetration testing on a Python web application running in a Docker container. In this white-box pentest, we will go through how to debug Python in VS...

This article explains some novel techniques for exploiting server-side template injections (SSTIs) with complex, unique payloads that leverage default methods and syntax from various template engin...

Having access to your target’s source code is obviously an invaluable advantage of white-box penetration testing. This article will help you leverage that benefit in the context of PHP application...

This article is about a vulnerability that I discovered in a company that I unfortunately cannot name. This company offers a service where other companies can write and share documents online. The ...

In this article we’ll summarise how various active and passive scanning tools can automate and streamline your Burp Suite workflow – saving you time in the process. You can find the full article...

JavaScript, a programming language widely used on the Internet, can be utilized on both the client and server side for development. It’s implemented on almost all web pages. This article will delve...

In this article we will outline various black-box testing techniques and their usefulness in performing offensive tests against web applications. We will also examine the ways in which payloads are...