GraphQL Vulnerabilities from an Attacker's Perspective
What GraphQL vulnerabilities are and how to find them in bug bounty — introspection, IDOR/BOLA, injection, and rate-limit bypass via batching, explained from scratch with examples.
Burak Dirlik
SSRF Deep Dive: From Internal Services to Cloud Metadata
From basic internal port scanning to AWS/GCP metadata exploitation — SSRF walked through real pentest scenarios, filter bypasses, and cloud attack paths.
JWT Attacks: A Pentester's Playbook Through Real Scenarios
From alg:none to kid injection, from algorithm confusion to jku manipulation — the JWT attack surface walked through real pentest scenarios.
Mass Assignment: A Silent but Devastating API Vulnerability
The technical origin of the Mass Assignment vulnerability, scenario-based exploitation examples, real-world cases, and framework-specific defense methods.
Privilege Escalation in Active Directory: RBCD Attack
What is Resource-Based Constrained Delegation, how is it exploited, and a full end-to-end attack chain walk-through using RBCD-Pwn.