Web security & pentesting
13 reports // How the web works and how it breaks: HTTP and APIs, Burp Suite, authentication bypass, command injection, the OWASP Top 10 and how red teams test it all.
red teamingFeaturedRed Teaming vs. Pentesting: Are You Really Secure?
Think your annual pentest keeps you secure? Discover what Red Teaming is, how it differs from pentesting, and why it's the ultimate test of your security posture.
cybersecurityFeaturedOWASP Top 10 2025: The 10 Deadly Web Traps Even Your Grandma Could Fall Into (And How to Escape Them)
Discover the OWASP Top 10 2025 . From broken locks to poisoned code, learn the biggest web security dangers - explained like a bedtime story. Perfect for beginners, developers, and anyone who uses the internet.
WebFeaturedWeb Requests Cheat Sheet: Mastering cURL, APIs, and DevTools for Bug Bounties
Hey, cyber sleuths! If you're diving into bug bounty hunting or sharpening your skills as a penetration tester, understanding web requests is your secret weapon. Tools like cURL let you poke, prod, and probe web applications with precision, uncovering vulnerabilities that automated scanners might miss. This blog takes the classic web requests cheat sheet—covering cURL commands, API interactions, and Browser DevTools shortcuts—and expands it with in-depth explanations. We'll dive into why each flag or technique is used, its core description, and how it fits into real-world scenarios. Plus, I'll throw in some advanced cURL techniques tailored for bug bounties, drawn from proven methodologies. Whether you're a junior SOC analyst monitoring traffic or a bug hunter chasing bounties, let's break it down step by step!
WebCRUD API Operations HTB
Hey, cyber warriors! Ready to dive into the world of APIs? In the **Web Requests** TryHackMe room, the **CRUD API** section explores how web applications use APIs to interact with databases, letting you create, read, update, and delete data with HTTP methods. This is like wielding a Swiss Army knife for web data manipulation—essential for SOC analysts spotting malicious API calls or pentesters exploiting misconfigured endpoints. We’ll break down the CRUD operations (Create, Read, Update, Delete), walk through TryHackMe’s hands-on tasks, and sprinkle in real-world examples and research to keep it practical. Let’s get started!
WebHTTP POST Requests Explained: Login Forms, Cookies and JSON
How HTTP POST requests work and why they matter for security: login forms, authenticated session cookies and JSON APIs, with the cURL command to send each one.
WebWeb Request Part 2
Welcome back, cyber crew! In [Part 1](Web_Requests_Blog_Part1.md), we covered **HTTP**, **URLs**, **DNS**, and **cURL**—the basics of how web requests work. Now, in Part 2, we’re diving deeper into the **Web Requests** TryHackMe room to explore **HTTPS**, **HTTP requests and responses**, **headers**, **methods**, and **authentication**. These are the nuts and bolts of secure web communication and common attack vectors. I’ll keep it chill, like we ’re geeking out over coffee, with real-world examples and some extra research to make it practical. Let’s get to it!
WebWeb Request Part 1
Hey there, cyber curious! If you’re new to cybersecurity or just want to know how the internet works under the hood, the **Web Requests** HackTheBox Module is a fantastic starting point. This module dives into how websites communicate using the **HyperText Transfer Protocol (HTTP)**, breaks down **URLs**, explains **DNS resolution**, and introduces **cURL**—a must-have tool for pentesters. Think of this as your guide to becoming a web wizard, explained like we’re chatting over pizza. I’ll weave in real-world examples, insights from TryHackMe, and some extra research to make it fun and practical. Let’s jump in!
WebHow Websites Work TryHackMe Walkthrough (All Answers)
All five tasks of TryHackMe's How Websites Work room, answered: HTML, JavaScript, sensitive data hidden in page source, and HTML injection with a malicious link.
WebDNS in Detail
The DNS in Detail TryHackMe room is your crash course in the Domain Name System (DNS), the internet’s address book that turns domain names (like google.com) into IP addresses. You’ll learn how DNS resolves names to IPs, the domain hierarchy (like TLDs and subdomains), and record types (A, AAAA, MX, CNAME, TXT). Tasks include querying DNS records using a simulated tool, answering questions like “What’s the CNAME of shop.website.thm?” (Answer: shops.myshopify.com). You’ll also explore rules, like subdomains being limited to 63 characters and not allowing underscores. Real-world example: In 2023, attackers used DNS tunneling to exfiltrate data from compromised networks, showing why understanding DNS is key for SOC analysts. This room’s hands-on exercises, like sending DNS requests, make it a great primer for networking and cybersecurity.
WEBContent Discovery THM
The Content Discovery TryHackMe room is all about finding hidden or private content on webservers that could lead to vulnerabilities. You’ll learn techniques like brute-forcing directories with tools like Gobuster, checking robots.txt, or using browser developer tools to uncover sensitive files or endpoints. Tasks include finding hidden pages to reveal flags, showing how attackers exploit misconfigured servers. Real-world example: In 2020, misconfigured AWS S3 buckets exposed sensitive data due to poor content protection. This room’s exercises, like discovering a secret admin panel, teach you how to think like a hacker and why securing web content is vital. It’s a practical, beginner-friendly way to dive into web pentesting.
WebCommand Injection THM
The Command Injection TryHackMe room teaches you how attackers can run malicious commands on a server by exploiting unsanitized inputs. You’ll deploy a vulnerable machine and practice injecting commands like whoami or cat /etc/passwd into input fields, seeing how they execute on the server. The room covers how attackers chain commands (using && or |) to escalate privileges or steal data. It’s a hands-on way to learn why input validation is crucial. Real-world example: In 2017, attackers used command injection in a web app vulnerability to compromise Equifax’s servers, leading to a massive data breach. By completing tasks like injecting commands to reveal flags, you’ll understand how to spot and prevent this dangerous attack vector in real systems. This room is a must for aspiring pentesters.
WebAuthentication Bypass TryHackMe Walkthrough (All Answers)
Every task in TryHackMe's Authentication Bypass room, answered and explained: username enumeration, brute-forcing logins, the password-reset logic flaw and cookie tampering.
WEBBurp Suite: The Basics TryHackMe Walkthrough (All Answers)
A task-by-task walkthrough of TryHackMe's Burp Suite: The Basics room: installing Burp, the dashboard, proxying traffic with FoxyProxy and HTTPS, scoping a target, and a first example attack.