The author describes discovering a medium‑severity information‑leak vulnerability in an educational portal by using a Google dork to locate a file exposing three default test accounts, then logging in with the admin credentials (password 123456) after other attack attempts failed.
This article details a step‑by‑step penetration test on a university’s web platform, covering XSS file uploads, JWT tampering for arbitrary login, massive personal data leakage, SQL injection payloads, and the exposure of several AK/SK secrets, all with concrete screenshots and commands.
The article details an authorized penetration test of a university campus app, revealing sensitive data leakage, horizontal and vertical privilege escalation, face‑photo tampering, and a stored XSS flaw, each demonstrated step‑by‑step with packet captures and screenshots.
The article analyzes how everyday posts on platforms like WeChat, GitHub, and TikTok can be harvested as open‑source intelligence, enabling phishing, BEC, and deep‑fake attacks, and offers concrete mitigation steps for security professionals.
This article details the discovery and exploitation of an API‑based information leakage in a university system, showing how default passwords, missing parameters, and directory depth allowed an attacker to retrieve thousands of student records, and concludes with lessons for security testing.
This article presents a collection of Spring Boot security vulnerabilities, detailing information leakage and remote code execution cases, with step‑by‑step exploitation guides and underlying principles, intended for security research and authorized testing only.
