Web Security
Injection, deserialization, access control, SSRF, and the API logic flaws that scanners miss.
- •4 min read•web-securitybackend
Introduction to Web Services and APIs
Web Services vs APIs, what's the difference? In this post, I break down XML-RPC, JSON-RPC, SOAP, REST and more with real code examples
- •5 min read•toolingweb-security
cURL Exploitation - Hoperation Eggsploit TryHackMe
A hands-on walkthrough of TryHackMe's cURL exploitation room - learning HTTP requests, POST data, cookies, sessions, and brute force attacks from the command line.
- •6 min read•vulnerability-researchautomation
n8n CVE-2025-68613: When Workflow Automation Goes Wrong
A comprehensive look at CVE-2025-68613 in n8n - how expression injection can lead to remote code execution and what you can do to protect yourself.
- •5 min read•web-securityctf
Advent of CTF 2025: Day 5 - Kramazon
Web exploitation challenge targeting a malicious e-commerce platform with cookie manipulation and privilege escalation vulnerabilities.
- •4 min read•vulnerability-researchweb-security
Django CVE-2025-64459: ORM Query Injection Explained
A friendly walkthrough of Django CVE-2025-64459 - understanding and exploiting ORM query parameter injection vulnerabilities in web applications.
- •5 min read•web-securityforensics
TryHackMe: Web Attack Forensics - Drone Alone
A comprehensive blue team investigation walkthrough of the TryHackMe Web Attack Forensics room, analyzing malicious web activity and command injection attacks using Splunk.
Critical remote code execution vulnerability in React Server Components affecting versions 19.0.0-19.2.0 through unsafe deserialization of client payloads
CVSS: 1012/4/2025