Notes and articles on security research and software development.
RSS feedA walkthrough of the Public Exploits exercise in HTB Academy’s Getting Started module. I scan with Nmap, find a vulnerable WordPress plugin, and use Metasploit to read the flag, after losing hours to overthinking something simple
Read articleA step-by-step web enumeration walkthrough from the Hack The Box CPTS Getting Started module. Fingerprinting the server with whatweb, scanning directories with gobuster, and finding a hidden admin page through robots.txt.
Read articleA newly disclosed iOS flaw called worse_query can let a malicious app read files from other apps on iOS 26.7.1, 27.0.1, and 27.2. Here's how it works, who is at risk, and what to do right now
Read articleKaspersky says Apple declined to pay a bug bounty for four iPhone zero-days found during Operation Triangulation. Here is what is confirmed, what is disputed, and what nobody has proven.
Read articleA practical note on considering security, reliability, and effectiveness while shaping software.
Read article