Vulnerability
DNS Zone Transfers: Finding and Fixing Unrestricted AXFR
How I test DNS zone-transfer permissions, interpret the response, and restrict transfers without breaking secondary DNS servers.
#web
Tools and Scripting
reconFTW: Building a Repeatable Reconnaissance Workflow
How I set up reconFTW, choose a bounded workflow, and turn collected reconnaissance data into findings I can verify.
Security Blogs
Reverse Analytics Lookup: Connecting Domains Through Shared Tags
How I use shared analytics identifiers as OSINT leads, account for historical data, and avoid treating a common tag as proof of ownership.
Security Blogs
XSS Payloads in JSP: Why the Output Context Matters
How I evaluate a small set of historical XSS probes and separate WAF behavior from a browser-confirmed application vulnerability.
Security Blogs
40 Security Research Resources, Grouped by the Question They Answer
A practical directory for infrastructure research, threat intelligence, code search, and historical context, with corrections to older entries.
Security Blogs
Download Website Files Recursively with Wget
How I use Wget to download linked files under a web directory, control recursion, and check what was saved.
Tools and Scripting
OutBandit: Investigating Out-of-Band Application Behaviour
Why I built OutBandit for Burp Suite, how I approach callback testing, and what an HTTP or DNS interaction can actually prove.
Capture The Flag
MuzzyBox: Practising Injection and Linux Privilege Boundaries
An introduction to my MuzzyBox CTF and the questions I use to investigate NoSQL injection, Python evaluation, SSTI, and Linux escalation.
Capture The Flag
FinitHicDeo: A CTF Built Around Protocol Behaviour
An introduction to FinitHicDeo, its programming and request-smuggling themes, and the evidence I would keep while solving the lab.
Tools and Scripting
Nuclei: Repeatable Security Checks with Templates
How I use Nuclei templates to run focused security checks, preserve evidence, and validate findings before reporting them.
Vulnerability
Server-Side Template Injection: Testing the Template Boundary
How I identify server-side template injection, reproduce it in a small Flask lab, and fix the separation between template source and data.
All 11 posts shown