Newsletter Archive
66 issues from the weekly era, kept online for reference, plus the one that closed it.
Sep 20, 2026
The Last Weekly Issue (and What Comes Next)
Why the weekly newsletter ends here, what I will send from now on, and an honest note about how the old issues were made.
Sep 5, 2026
Heap Exploitation: Corrupting the glibc Allocator
glibc malloc internals, use-after-free, tcache poisoning past safe-linking, double-free and fastbin dup, and turning an arbitrary write into a shell
Aug 29, 2026
SQL Injection Deep Dive: Blind, Out-of-Band, and Shell
UNION extraction, boolean and time-based blind with binary search, error-based leaks, DNS out-of-band exfil, SQLi to RCE, and WAF bypass
Aug 22, 2026
Mass Assignment: The Field the UI Never Shows You
Auto-binding abuse, injecting is_admin and role fields for privilege escalation, hidden parameter discovery, and HTTP Parameter Pollution
Aug 15, 2026
Stack Overflows to ROP: Beating NX, Canaries, ASLR
Overwriting the return address, ret2libc past NX, ROP gadget chains, leaking stack canaries, and defeating ASLR with a puts/GOT libc leak
Aug 8, 2026
XS-Leaks: Turning the Browser Into a Side Channel
Same-origin policy defeated by observation: error-event oracles, frame counting via window.length, connection-pool timing, cache probing, and char-by-char XS-Search
Aug 1, 2026
Upgradeable Proxies: When the Upgrade Is the Attack
Delegatecall storage takeover, slot-0 storage collisions, uninitialized implementations, UUPS selfdestruct bricking (Parity/Wormhole), and initializer front-running
Jul 25, 2026
Supply Chain Attacks: Owning the Install Step
Dependency confusion, typosquatting on npm and PyPI, install-script code execution, maintainer account takeover, and the Shai-Hulud self-replicating npm worm
Jul 18, 2026
Breaking the Browser: WASM and WebGPU Exploitation
JIT type confusion in V8, WebAssembly RWX shellcode primitives, heap grooming with typed arrays, WebGPU/Dawn GPU-process bugs, and the multi-process sandbox escape chain
Jul 11, 2026
Cross-Chain Bridges: Minting Money From Nothing
Lock-and-mint trust models, validator key theft (Ronin), signature verification bypass (Wormhole), zero-root init bugs (Nomad), and Merkle proof forgery (BNB Token Hub)
Jul 4, 2026
Reentrancy: The Bug That Forked Ethereum
Classic single-function reentrancy, cross-function bypass of nonReentrant guards, read-only reentrancy via view oracles, ERC-777 token hooks, Vyper compiler bug, and Slither detection
Jun 28, 2026
Flash Loans: Borrowing Billions to Break DeFi
Flash loan anatomy via Aave V3, AMM spot price oracle manipulation, governance hijacking with borrowed tokens, MEV sandwich attacks via Flashbots, and the Euler Finance $197M exploit
Jun 21, 2026
Offensive eBPF: The Kernel as Your Backdoor
eBPF rootkit mechanics, PAM credential harvesting via uprobes, process and connection hiding via getdents64 hooks, XDP magic-packet backdoor, and nation-state deployments
Jun 14, 2026
SAML SSO Exploitation: Breaking the Trust Chain
XML signature wrapping variants, void canonicalization bypass, NameID comment injection, SAML attribute injection, and token replay against enterprise SSO
Jun 7, 2026
SyncJacking: On-Prem AD to Cloud Admin
Entra Connect hard-match hijacking, MSOL credential extraction, PTA agent backdoor, sync API abuse, and attack path mapping with AzureHound
May 31, 2026
Device Code Phishing: Stealing Tokens via Real Login
RFC 8628 device flow abuse, QR code social engineering, Storm-2372 token theft, TokenTacticsV2 commands, and Entra ID Conditional Access blocking
May 24, 2026
SCIM Exploitation: Hacking the Provisioning Layer
SCIM recon via ServiceProviderConfig, externalId collision for admin takeover, email hijacking via PATCH, unauthenticated endpoints, and group membership escalation
May 17, 2026
MCP Security: Poisoning the Tools Your AI Trusts
Tool poisoning via description fields, rug pull attacks, cross-server shadowing, RCE in MCP client tooling, and DVMCP practice lab
May 10, 2026
Prompt Injection: Hacking LLMs in 2026
Direct and indirect prompt injection, agent hijacking via tool abuse, system prompt leakage, RAG poisoning, and automated testing with garak
May 3, 2026
AWS Privilege Escalation: From Low-Priv Key to Admin
IAM policy attachment abuse, PassRole via Lambda for indirect escalation, EC2 instance profile exploitation, and PMapper for automatic path discovery
Apr 26, 2026
WebSocket Security: Hijacking, Injection, and Tunneling
Cross-site WebSocket hijacking, message-level XSS and SQLi, WebSocket smuggling for firewall bypass, and the toolset for interactive testing
Apr 19, 2026
GitHub Actions: Pipelines as Attack Surface
pull_request_target pwn requests, script injection via expressions, secrets exfiltration, poisoned pipeline execution, self-hosted runner persistence, and Gato-X
Apr 12, 2026
XSS: Reflected, Stored, DOM, and Blind
DOM source/sink model, stored XSS in rich-text editors, blind XSS against admin panels, framework pitfalls in React and Angular, and dalfox for scanning
Apr 5, 2026
DNS as a Weapon: Poisoning, Tunneling, and Rebinding
Kaminsky cache poisoning mechanics, SAD DNS side-channel attack, C2 over DNS with dnscat2, exfiltration techniques, and DNS rebinding to bypass Same-Origin Policy
Mar 29, 2026
OAuth 2.0: Six Ways the Authorization Flow Breaks
Missing state CSRF, redirect_uri hijacking, open redirect code theft, implicit flow token leakage, PKCE bypass, and SSRF via OpenID dynamic client registration
Mar 22, 2026
NoSQL Injection: Breaking MongoDB From the Inside
Operator injection, authentication bypass with $ne and $regex, blind boolean extraction, time-based $where detection, CouchDB default access, and automation tools
Mar 15, 2026
Redis and Memcached: When Cache Becomes a Foothold
Unauthenticated access, file-write RCE, module loading, SSRF via Gopher, CVE-2022-0543 Lua sandbox escape, and Memcached data extraction
Mar 8, 2026
Race Conditions: When Timing Is Everything
TOCTOU mechanics, limit overrun attacks, multi-endpoint races, and the single-packet technique that makes all of this consistently exploitable
Mar 1, 2026
WiFi Hacking 101: Wrapping Up the Series (Part 4)
PEAP relay attacks, ESSID stripping for WIDS bypass, and a complete wireless assessment checklist for enterprise engagements
Feb 22, 2026
WiFi Hacking 101: Exploiting Enterprise Networks (Part 3)
Breaking into 802.1X enterprise WiFi through credential capture, legacy method exploitation, and Pass-the-Hash attacks
Feb 15, 2026
WiFi Hacking 101: WPA/WPA2 Cracking, PMKID, and WPS (Part 2)
From 4-way handshake capture to offline cracking: WPA/WPA2 attacks, PMKID exploitation, WPS vulnerabilities, and what WPA3 actually protects against
Feb 8, 2026
Infrastructure Reconnaissance: Your First Steps in Network Pentesting
From nmap and nuclei to full infrastructure enumeration: a practical guide to discovering attack surface in bug bounty and pentesting
Feb 1, 2026
WiFi Hacking 101: Breaking Into Wireless Networks (Part 1)
A practical introduction to WiFi security testing covering the fundamentals, essential hardware, monitor mode, packet injection, and initial attack techniques
Jan 25, 2026
Deserialization Attacks: When Objects Become Weapons
From Java gadget chains to Python pickle exploits: a practical guide to exploiting insecure deserialization for remote code execution
Jan 18, 2026
Kubernetes for Pentesters: Breaking Orchestrated Infrastructure from Zero
From your first pod compromise to full cluster takeover: a practical introduction to Kubernetes security testing
Jan 11, 2026
Server-Side Template Injection (SSTI): Breaking Out of Templates
How attackers exploit template engines to achieve remote code execution by injecting malicious payloads into server-side templates
Jan 4, 2026
gRPC Security: Breaking the High-Performance RPC Protocol
A practical guide to gRPC security testing covering service enumeration, metadata exploitation, authentication bypass, and protobuf manipulation
Dec 28, 2025
LDAP Injection: Breaking Active Directory Authentication & Enumeration
A deep dive into LDAP injection exploitation, blind LDAP attacks, advanced AD enumeration via LDAP queries, and pass-back attacks against LDAP servers
Dec 21, 2025
iOS Security Testing: From IPA Analysis to Runtime Manipulation
A practical guide to iOS pentesting covering IPA decompilation, Frida hooking, certificate pinning bypass, and jailbreak detection circumvention
Dec 14, 2025
AWS for Pentesters: Your First Steps into Cloud Hacking
A beginner-friendly introduction to AWS security testing, from S3 buckets and metadata services to your first cloud foothold
Dec 7, 2025
Rust Security Code Review: When Memory Safety Isn't Enough
How to find vulnerabilities in Rust codebases despite the borrow checker, from unsafe blocks to logic bugs the compiler can't catch
Nov 30, 2025
HTTP Request Smuggling: The Art of Confusing Web Servers
How attackers exploit parsing discrepancies between frontend and backend servers to bypass security controls, poison caches, and hijack sessions
Nov 23, 2025
File Upload Vulnerabilities: From Filter Bypass to Full System Compromise
How attackers turn innocent file uploads into webshells, arbitrary code execution, and complete server takeovers
Nov 16, 2025
Prototype Pollution: Hacking JavaScript From the Inside
How modifying Object.prototype can lead to RCE, XSS, and complete application compromise
Nov 9, 2025
Docker Escape: Breaking Out of Containers
From misconfigured containers to full host compromise: a practical guide to container breakout techniques
Nov 2, 2025
XXE Injection: When XML Parsers Become Your Worst Enemy
From basic file disclosure to blind out-of-band exfiltration: a practical guide to finding and exploiting XXE vulnerabilities
Oct 26, 2025
NTLM Relay: Why Authentication in AD is Still Broken
How to force machines to authenticate to you, relay their credentials, and take over domains
Oct 19, 2025
CSP for Pentesters: Understanding the Fundamentals
Understanding the basics and spotting weak configurations
Oct 12, 2025
Hardware Security Modules: The Fortress Guarding Blockchain's Crown Jewels
How exchanges and institutions actually protect billions in crypto assets
Oct 5, 2025
Predictable Contracts: Understanding CREATE and CREATE2 in Ethereum
How deterministic addresses unlock powerful features and subtle attack vectors auditors should never overlook.
Sep 28, 2025
The Day an Email Broke Single Sign-On
Exploiting weak email validation in OAuth2 SSO
Sep 21, 2025
Taming the Beast: Practical Code Review with Security Tools
From endless lines of code to streamlined reviews with TruffleHog, CodeQL, and Trivy.
Sep 14, 2025
Bypassing Cloud Firewalls: Size Does Matter
Bypassing Akamai, CloudFront & Cloudflare with oversized requests.
Sep 6, 2025
ERC-20s in the Wild: Why Vanilla Assumptions Breaks
When ERC-20s Don’t Play Nice
Jul 13, 2025
Breaking Mobile-to-Device Logic: When BLE Access Falls Apart
Mobile apps that unlock doors might seem secure — until you replay a BLE packet, go offline, or bypass the logic entirely.
Jul 6, 2025
Reversing Android Apps: Bypassing Detection Like a Pro
Techniques to bypass root, Frida, and SSL protections in modern Android apps
Jun 29, 2025
When Web3 Withdrawals Meet Web2 Logic
How classic backend bugs like race conditions and IDORs still break Web3 withdrawal flows today
Jun 22, 2025
Cracking the iOS Keychain: What It Protects, Where It Fails
iOS Keychain 101: What It Is and How to Hack It
Jun 15, 2025
Android Keystore: Fort Knox or Glass Box?
Breaking and Defending Android’s Key Vault
Jun 8, 2025
Active Directory Enumeration: Mapping the Kingdom Before the Siege
Usernames, sessions and hidden privilege paths: uncovering the domain’s true structure
May 31, 2025
Biometric Authentication: Pretty Face, Weak Shield?
How biometric checks fool developers and how you can fool them back.
May 25, 2025
The Anatomy of a JWT Hack
JWTs: Small Tokens, Big Mistakes
May 18, 2025
🐙 Hacking GitHub – A Beginner’s Guide to Finding the (Not So) Hidden Stuff
Learn how exposed .git folders, sloppy commits, and forgotten tokens can turn a dev's mistake into your recon goldmine.
May 11, 2025
Inside the Request: From Basic SSRF to Internal Takeover
A practical guide to finding and exploiting SSRF vulnerabilities in modern applications.
May 4, 2025
Breaking Flutter: A Pentester’s Guide to Dart, Snapshots, and TLS Bypasses
Real-world techniques and tools for reversing Flutter apps, bypassing TLS pinning, and understanding how Dart code gets shipped in production.
Apr 27, 2025
Kerberos Tactics Every Pentester Should Know
A hands-on guide to the most effective Kerberos attacks in Active Directory environments
Apr 20, 2025
First Issue – Let’s Go
First Newsletter!