Web Exploitation Prototype Pollution in JavaScript Applications
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
RCE
Web Exploitation 
Windows Privesc PrintNightmare: Abusing the Windows Print Spooler for Privilege Escalation and RCE
A practical walkthrough of CVE-2021-1675 and CVE-2021-34527 (PrintNightmare): abusing AddPrinterDriverEx for SYSTEM-level code execution, plus blue-team defenses.
Security Remote File Inclusion (RFI) Fundamentals: From allow_url_include to RCE
Learn how Remote File Inclusion abuses PHP wrappers and allow_url_include to achieve remote code execution, plus blue-team defenses.
Web Exploitation From LFI to RCE: Practical Escalation Techniques
How to escalate a PHP Local File Inclusion into remote code execution via log poisoning, php://filter, data wrappers, sessions and /proc.
Web Exploitation Insecure Deserialization: Exploiting PHP and Java Object Injection
How PHP unserialize and Java deserialization lead to RCE via magic methods and gadget chains, plus blue-team defenses.
Web Exploitation Exploiting File Upload Vulnerabilities: From Bypass to Webshell
A practical guide to bypassing file upload filters with double extensions, content-type, and magic bytes to land a webshell, plus defenses.
Security Server-Side Template Injection: From {{7*7}} to RCE
A practical guide to Server-Side Template Injection: detecting, fingerprinting, and escaping Jinja2 and Twig sandboxes to achieve RCE.
Tools & Defense Log4Shell (CVE-2021-44228): Anatomy of the JNDI/LDAP Exploit
A practical breakdown of Log4Shell: how the JNDI/LDAP lookup leads to RCE, a marshalsec PoC, WAF bypass tricks, and defenses.
Cloud Security Breaking Serverless: Attacking AWS Lambda from Event Injection to RCE
How attackers turn Lambda event injection into code execution and credential theft, and how blue teams stop it.