This article details step‑by‑step packet‑capture techniques using Fiddler, Burp and Clash, Google‑hacking for credentials, and then demonstrates extracting and abusing sensitive student data from a university WeChat mini‑program and its backend information system, including enumeration, XSS and data modification.
OALABS recovered over 1,000 Claude and Codex session logs from a compromised server, revealing how the attackers duplicated AI agents, used them for reconnaissance, vulnerability exploitation, data theft, and even attempted cryptocurrency cracking across at least 14 companies, demonstrating that AI agents can dramatically lower the technical barrier for sophisticated cyber‑attacks.
This article compiles over 700 high‑quality open‑source security projects from GitHub, categorised by functional scenarios such as automated reconnaissance, information gathering, vulnerability exploitation, internal network penetration, evasion, and incident response, providing a comprehensive practical toolkit for red‑team, blue‑team and security researchers.
Shannon is an AI‑driven penetration testing agent that automatically discovers, exploits, and reports vulnerabilities with zero false positives, achieving a 96.15% exploit success rate across OWASP Juice Shop and other benchmarks, while offering fully autonomous operation, code‑aware attacks, and parallel processing.
The article analyzes how generative AI is transforming cybercrime by enabling 13 distinct attack methods—from highly personalized phishing emails and AI‑assisted malware creation to automated vulnerability hunting, deep‑fake social engineering, malicious LLMs, and attacks on AI infrastructure—highlighting recent research data and real‑world examples that illustrate the heightened speed, stealth, and accessibility of modern threats.
This guide walks through 30 hands‑on web penetration testing techniques covering the full workflow—from information gathering and vulnerability discovery to privilege escalation, internal network pivoting, and defense evasion—providing concrete commands, tool recommendations, and real‑world tips for security engineers and testers.
This article demonstrates how a NextJS SSRF vulnerability (CVE‑2024‑34351) can be exploited by abusing the HTTP Host header, walks through the underlying code, reproduces the attack to retrieve a protected flag file, and discusses mitigation strategies for developers.
This article explains why cloud platforms rely on access keys, describes common scenarios where AK/SK credentials are exposed, provides practical examples such as heapdump and JavaScript leaks, and shows how attackers can hijack storage buckets or execute commands on compromised cloud hosts.
This article explains how to combine reflected and stored cross‑site scripting attacks with same‑origin policy abuse to turn a low‑severity XSS vulnerability into a high‑severity issue, detailing discovery, exploitation steps, and a JavaScript payload that harvests user data.
This comprehensive guide explains how to improve penetration testing efficiency by focusing on port enumeration, banner grabbing, service identification, default port knowledge, and a variety of attack techniques—including brute‑force, exploitation of known vulnerabilities, and protocol‑specific tricks—across common network services and applications.
The article shows how attackers automate mass exploitation of widely‑known flaws—scanning the Internet for open MongoDB, Redis, ElasticSearch or Struts2 services, using unauthenticated access or public PoCs to encrypt data, execute code, or build botnets, and stresses that timely patching and secure defaults are essential to stop such N‑day attacks.
