Category: security
-
Case Study: IDOR via Predictable Username Generation
Interesting case study by @nahamsec on HackingHub: https://app.hackinghub.io/hubs/ghost-api
-
CVE-2025-55319: Agentic AI in VS Code – RCE
VS Code has a built-in AI feature (called “Agentic AI”) that can help you write code. This vulnerability is a “command injection” flaw. That’s a fancy way of saying: a hacker can trick the AI into running harmful commands on your computer, as if the hacker was sitting at your keyboard. Uploading a malicious .vsix…
-
CVE 2025-24071
Server-side ZIP extraction leads to NTLM hash leakage. This specific vulnerability exploits NTLM Hash Leak via RAR/ZIP extraction and .library-ms file.
-
Burp Collaborator Server Setup
To protect clients, setting up a private Collaborator Server is an important step before any out of band web security testing. Considering the number of hours I spent researching the correct DNS settings, I have written a short guide to make life easier… For hosting, a digital ocean droplet was chosen. By default, all ports…