Articles
Thinking out loud on offensive security
Write-ups, techniques, and findings from real engagements and lab work. No fluff, just what actually worked.
-
Caido plugin – Scope Tools
https://github.com/mimiloveexe/scope-tools This caido plugin helps delete sitemap entries that do not match your scope presets, and erase out of scope requests in your HTTP history. The bonus is you can import requests to search from a previous export.
-
Case Study: IDOR via Predictable Username Generation
Interesting case study by @nahamsec on HackingHub: https://app.hackinghub.io/hubs/ghost-api
-
CVE-2026-27626: OliveTin
OliveTin is a tool that lets end-users run shell commands through a web interface. It has two serious bugs (tracked together as CVE-2026-27626) that let an attacker run any command they want on the server, without even needing to log in. Password fields: The app doesn’t clean up what users type into “password” fields before…
-
CVE-2025-55319: Agentic AI in VS Code – RCE
VS Code has a built-in AI feature (called “Agentic AI”) that can help you write code. This vulnerability is a “command injection” flaw. That’s a fancy way of saying: a hacker can trick the AI into running harmful commands on your computer, as if the hacker was sitting at your keyboard. Uploading a malicious .vsix…
-
CVE 2025-24071
Server-side ZIP extraction leads to NTLM hash leakage. This specific vulnerability exploits NTLM Hash Leak via RAR/ZIP extraction and .library-ms file.
-
Burp Collaborator Server Setup
To protect clients, setting up a private Collaborator Server is an important step before any out of band web security testing. Considering the number of hours I spent researching the correct DNS settings, I have written a short guide to make life easier… For hosting, a digital ocean droplet was chosen. By default, all ports…