NahamSec discusses a lucrative Remote Command Execution


$30,000 Blind & Time Based Remote Command Execution

The website allows free users to create only two projects. But I found that if I sent many requests at the same time, I could create more than two projects.

Race Condition allowing creation of unlimited projects

In just three Sunday afternoons, I discovered 14 CVEs - and you can too!

CVE Hunting Made Easy

Accessing other shops orders via a cache misconfiguration

Authorization bypass due to cache misconfiguration

I’m going to walk you through how I discovered a hidden vulnerability in an application that led to a Reflected Cross-Site Scripting.

Hidden Reflected XSS on 403 Page

How I Hacked Into a Nationwide University Database System Exposing Thousands of Student Records

Hacking a Nationwide University Database System 

Bypassing Filters: SSRF Exploitation via DNS Rebinding with Just 1 in 30 Successful Requests

SSRF Exploitation via DNS Rebinding

Why Windhustler Left Kotlin Behind to Make Money in Crypto Auditing

Web3 Security Podcast

In this blog post, I’ll walk you through how I discovered a rate-limit bypass vulnerability that led to an account takeover.

How I Turned a Rate-Limit Bypass into an Account Takeover

This article goes through a remote code execution finding worth $$$$ that I found on one of the popular chatbot platforms so let's get started.

Unveiling Remote Code Execution in AI chatbot workflows

In this post, I’ll explain how I discovered a critical vulnerability that allowed me to take over a server with root access, without any restrictions!

SSRF to Server Takeover PoC

Learn how to tune Nmap to get port scans completed faster without negatively impacting scan accuracy, or causing an outage.

Browse Bug Bounty Content

Discover the best Bug Bounty pentesting and infosec content, updated every day.