Next.js middleware authentication bypass (CVE-2025-29927), LFI for credential extraction, and Terraform provider override for root.
Blog
“The sky above the port was the color of television, tuned to a dead channel.”
Methodology posts, HackTheBox writeups, tooling notes, and opinionated pieces.
Web Application Security Checklist for Penetration Testers
A systematic checklist covering every phase of a web application security assessment — from recon and auth testing to business logic flaws and reporting.