Web Exploitation SSRF Deep Dive: Pivoting to Cloud Metadata, Internal Scans, and Filter Bypass
A practical guide to Server-Side Request Forgery: cloud metadata theft, internal port scanning, filter bypass, and Blue Team defenses.
2026-01
Web Exploitation 
Web Exploitation XXE Attacks: Exploiting XML External Entities for File Disclosure and Blind OOB Exfiltration
A practical guide to XML External Entity attacks — DOCTYPE abuse, file disclosure, SSRF, blind/OOB exfiltration, and defense.
Web Exploitation Cross-Site Scripting (XSS): A Practical Primer
A hands-on primer on reflected, stored, and DOM-based XSS, cookie theft, and modern CSP bypass techniques.
Web Exploitation Insecure Deserialization: Exploiting PHP and Java Object Injection
How PHP unserialize and Java deserialization lead to RCE via magic methods and gadget chains, plus blue-team defenses.
Web Exploitation OS Command Injection: From Shell Metacharacters to Blind Exfiltration and Filter Bypass
A practical guide to OS command injection: shell metacharacters, blind techniques, IFS-based filter bypass, and blue-team defenses.
Web Exploitation Path Traversal: Escaping the Web Root with ../, Encoding Tricks, and Null Bytes
A practical guide to directory traversal: dot-dot-slash, encoding bypasses, absolute paths, null bytes, plus blue-team defenses.
Web Exploitation Exploiting File Upload Vulnerabilities: From Bypass to Webshell
A practical guide to bypassing file upload filters with double extensions, content-type, and magic bytes to land a webshell, plus defenses.
Web Exploitation JWT Vulnerabilities and Attacks: alg none, Key Confusion, and kid Injection
A practical guide to exploiting JSON Web Token flaws — alg=none, key confusion, weak secrets, and kid injection — plus defenses.
Web Exploitation IDOR and Broken Access Control: Exploiting Insecure Direct Object References
A practical guide to finding and exploiting IDOR/BOLA flaws through parameter tampering and enumeration, plus blue-team defenses.
Security Server-Side Template Injection: From {{7*7}} to RCE
A practical guide to Server-Side Template Injection: detecting, fingerprinting, and escaping Jinja2 and Twig sandboxes to achieve RCE.
Security Authentication Bypass Techniques: Logic Flaws, SQLi, Weak Resets, and 2FA Bypass
A practical walkthrough of four authentication bypass classes — logic flaws, SQLi, weak password resets, and 2FA bypass — with detection and defense.
Web Exploitation CSRF Attacks and Defenses: Forging State-Changing Requests
How Cross-Site Request Forgery hijacks authenticated sessions, with a hands-on PoC and modern token/SameSite defenses.
Web Exploitation Web Cache Poisoning: Weaponizing Unkeyed Input
How attackers turn unkeyed inputs like X-Forwarded-Host into stored XSS via shared caches, and how to defend.
Web Exploitation Attacking GraphQL APIs: Introspection, Batching, IDOR, and DoS
A practical guide to GraphQL pentesting: fingerprinting with graphw00f, introspection, batching, IDOR, and DoS, plus blue-team defenses.
Tools & Defense Nmap in Practice: A Pentester’s Guide to Scanning, NSE, and Timing
A practical, accurate Nmap workflow covering host discovery, -p-, -sC -sV, NSE scripts, and timing — plus blue-team detection.