Intro If you do source code reviews on a regular basis, you are bound to eventually stumble upon the use of pseudo-random number generators (PRNGs) to generate secrets like reset tokens or tempora...

Intro At the very start of the ML hype, I decided to look at some open-source bug bounty programs on the huntr.com platform. I ended up choosing the MLFlow program, as it had some interesting bugs...

Intro I last visited Hackthebox quite a while ago, and I was delighted to see that the team has added cool challenges for our blue teamers, too! They are called HTB Sherlocks. In each Sherlock, y...

Intro Long story short, while preparing for my OSWE exam back in early 2022, I stumbled over a list of OSWE-like HTB boxes, and decided to give it a try. Celestial was one of them. While it was a ...

Does anybody even need this? :D Expanding on the topic So, in my first article, we explored the possibility of abusing excessive server-side file read and write permissions to perform an RCE ...

SELECTing your way to RCE. A way to pwn Postgres without stacked SQLi queries An unusual problem A while ago I stumbled upon a very specific instance of a Postgres SELECT SQLi. The DB data was of...

New Burp feature On October 20th, 2023 Portswigger released a neat feature – Java Bambdas. Basically, they are just Java code snippets dynamically compiled and run by BurpSuite. At the time of wri...