📌 bookmark.cxbt.kr

suzulabs.com

The Death of the CTF: How Agentic AI Is Reshaping Competitive Hacking

asset-group.github.io

The AI refused to steal the secrets. So we handed it a form.

any.run

Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup

DEF CON 34 :: Weaponizing Windows PnP

getdesign.md

Design System Analysis: Notion

www.hacktron.ai

Watching GPT-5.6 Sol Ultra Write a Chrome Exploit: Exploit Development as We Know It Is Dead

blog.78researchlab.com

펌웨어 추출 방법

blog.orange.tw

A New Attack Surface on MS Exchange Part 1 - ProxyLogon!

ACDC 2025 AI 해킹방어대회 Attack&Defense 후기

getdesign.md

Production-grade DESIGN.md collection

hermes-agent.nousresearch.com

Hermes Agent — The Agent That Grows With You

github.com

Yeachan-Heo/oh-my-codex

openai.com

Harness engineering: leveraging Codex in an agent-first world

labs.cloudsecurityalliance.org

The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program

justhaifei1.blogspot.com

EXPMON detected sophisticated zero-day fingerprinting attack targeting Adobe Reader users

ryelang.org

The Cognitive Dark Forest

theori.io

보안 담당자라면 꼭 알아야 할 점검 전략 가이드 | 모의해킹 vs 모의침투 vs 취약점 진단

www.enki.co.kr

ENKI Redteam CTF Writeup : Jeopardy

flatt.tech

Remote Command Execution in Google Cloud with Single Directory Deletion

www.synacktiv.com

Livewire: remote command execution through unmarshaling

futuresearch.ai

How a supply chain attack on PyPI got us through a Cursor-launched MCP server the old-fashioned way

www.stuartrankin.uk

IPv4 Obfuscation of Shellcode

www.schneier.com

3 Papers Regarding Side-Channel Attacks Against LLMs

www.opensourceprojects.dev

Verify Email Addresses Without Sending a Single Email

omeramiad.com

GatewayToHeaven: Finding a Critical Cross-Tenant Exploit in GCP’s Apigee

github.com

1nfin1ty Web challenge ( 0xL4ugh CTF v5 )

Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals

fearsoff.org

CloudFlare WAF Bypass Through ACME Path

sean.heelan.io

On the Coming Industrialisation of Exploit Generation with LLMs

sylvie.fyi

Using BMP Polyglots to get RCE

flatt.tech

https://flatt.tech/research/posts/pwning-claude-code-in-8-different-ways

phrack.org

Hacking does not confirm to just a computer, take a wilder approach.

loworbitsecurity.com

News: There Were BGP Anomalies During The Venezuela Blackout

blog.harold.kim

https://blog.harold.kim/2018/04/asisctf-2018-moehost-solution

new-blog.ch4n3.kr

LLM 으로 Django 0day 찾은 썰 👑

nanimokangaeteinai.hateblo.jp

https://nanimokangaeteinai.hateblo.jp/entry/2025/09/08/043631

labs.watchtowr.com

https://labs.watchtowr.com/you-already-have-our-personal-data-take-our-phone-calls-too-freepbx-cve-2025-57819/

canalun.company

https://canalun.company/posts/domdomtimes_iframe_is_not_secure_escape_hatch_en

blog.trailofbits.com

https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/

https://blog.slonser.info/posts/make-self-xss-great-again/

www.reddit.com

https://www.reddit.com/r/websecurityresearch/comments/1kqk5nn/using_random_peoples_browsers_to_ddos_others/

krebsonsecurity.com

https://krebsonsecurity.com/2025/06/inside-a-dark-adtech-empire-fed-by-fake-captchas/

https://localmess.github.io/

blog.includesecurity.com

https://blog.includesecurity.com/2025/04/cross-site-websocket-hijacking-exploitation-in-2025/

www.youtube.com

https://www.youtube.com/watch?v=EuHQZyTa91E

medium.com

https://medium.com/@sharon.brizinov/how-i-made-64k-from-deleted-files-a-bug-bounty-story-c5bd3a6f5f9b

invariantlabs.ai

https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

bishopfox.com

https://bishopfox.com/blog/unredacter-tool-never-pixelation

github.com

Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc’s iconv()

blog.lexfo.fr

https://blog.lexfo.fr/lightyear-file-dump.html

swarm.ptsecurity.com

https://swarm.ptsecurity.com/impossible-xxe-in-php/

blog.trailofbits.com

https://blog.trailofbits.com/2019/07/08/fuck-rsa/

blog.ethiack.com

https://blog.ethiack.com/blog/supercharging-bug-bounty-hunting-with-ai

portswigger.net

https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie

https://zhero-web-sec.github.io/research-and-things/nextjs-cache-and-chains-the-stale-elixir

gist.github.com

https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117

projectdiscovery.io

https://projectdiscovery.io/blog/guide-to-dns-takeovers

trufflesecurity.com

https://trufflesecurity.com/blog/millions-at-risk-due-to-google-s-oauth-flaw

blog.orange.tw

https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/

www.invicti.com

https://www.invicti.com/blog/security-labs/first-tokens-the-achilles-heel-of-llms/

labs.watchtowr.com

https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/

https://joaxcar.com/blog/2024/12/20/sideloading-external-scripts-a-code-golf-challenge/

https://www.jmeiners.com/lc3-vm/

blog.orange.tw

https://blog.orange.tw/posts/2018-10-hitcon-ctf-2018-one-line-php-challenge/

blo.zbss.site

https://blo.zbss.site/jsp-webshell-免杀/

securitybynature.fr

https://securitybynature.fr/post/hacking-cryptolib

thottysploity.github.io

https://thottysploity.github.io/posts/cve-2024-53375/

portswigger.net

https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties

outpost24.com

https://outpost24.com/blog/exploiting-permissive-cors-configurations/

aem1k.com

https://aem1k.com/invisible/

samcurry.net

https://samcurry.net/hacking-kia#http-request-to-search-vin-using-kia-dealer-apigw-endpoint-with-dda-access-token

vulncat.fortify.com

https://vulncat.fortify.com/ko/weakness

medium.com

https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

github.com

https://github.com/strellic/my-ctf-challenges

www.synacktiv.com

https://www.synacktiv.com/en/publications/github-actions-exploitation-self-hosted-runners

claroty.com

https://claroty.com/team82/research/pwn2own-wan-to-lan-exploit-showcase

github.com

https://github.com/smxiazi/xia_Liao

medium.com

https://medium.com/@proseizala/airbnb-when-bypassing-json-encoding-xss-filter-waf-csp-and-auditor-turns-into-eight-92a004f1cbe8

embracethered.com

https://embracethered.com/blog/posts/2024/chatgpt-persistent-denial-of-service/

github.com

https://github.com/blacklanternsecurity/bbot

github.com

https://github.com/yogeshojha/rengine

https://ios.cfw.guide/get-started/

aszx87410.github.io

https://aszx87410.github.io/beyond-xss/en/

browser.engineering

https://browser.engineering/

mrd0x.com

https://mrd0x.com/progressive-web-apps-pwa-phishing/

nickguitar.medium.com

https://nickguitar.medium.com/hacking-nasa-critical-ssrf-subdomain-takeover-xss-699be0ce3c06

github.com

https://github.com/m4ll0k/SecretFinder

https://www.alignmentforum.org/posts/vERGLBpDE8m5mpT6t/autonomous-replication-and-adaptation-an-attempt-at-a

github.com

https://github.com/zgzhang/cve-2024-6387-poc/

arxiv.org

https://arxiv.org/html/2404.14082v1

openai.com

https://openai.com/index/introducing-superalignment/

github.com

https://github.com/h4r5h1t/webcopilot

www.qualys.com

https://www.qualys.com/regresshion-cve-2024-6387/

drive.google.com

https://drive.google.com/file/d/1W33xHPBeqEkPf-FcvPWuXC4JGWar8wHt/view

https://www.freebuf.com/articles/web/255717.html

github.com

https://github.com/xcanwin/CVE-2023-4357-Chrome-XXE

medium.com

https://medium.com/@osamaavvan/breaking-down-dom-based-xss-a-practical-exploration-929d44f10906

samcurry.net

https://samcurry.net/hacking-millions-of-modems

security.lauritz-holtmann.de

https://security.lauritz-holtmann.de/post/sso-security-redirect-uri-iii/

securitylab.github.com

https://securitylab.github.com/advisories/GHSL-2023-235_GHSL-2023-237_Open_Metadata/

www.sonarsource.com

https://www.sonarsource.com/blog/pitfalls-of-desanitization-leaking-customer-data-from-osticket

www.youtube.com

https://www.youtube.com/watch?v=3WS4Iy14U3o

portswigger.net

https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/canary

github.com

https://github.com/advisories/GHSA-mw2w-2hj2-fg8q

labs.watchtowr.com

https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms/

ufo.stealien.com

https://ufo.stealien.com/2023-07-31/bughunting-vulnerability-chaining-ko

blog.torproject.org

https://blog.torproject.org/security-audit-report-tor-browser-ooni/

developer.mozilla.org

https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API

omergil.blogspot.com

https://omergil.blogspot.com/2017/02/web-cache-deception-attack.html

portswigger.net

https://portswigger.net/research/bypassing-dompurify-again-with-mutation-xss

www.sonarsource.com

https://www.sonarsource.com/blog/why-orms-and-prepared-statements-cant-always-win/

speakerdeck.com

https://speakerdeck.com/pwntester/attacking-net-serialization

thehackernews.com

https://thehackernews.com/2023/03/openai-reveals-redis-bug-behind-chatgpt.html?m=1

www.bentasker.co.uk

https://www.bentasker.co.uk/posts/documentation/linux/310-building-a-tor-hidden-service-from-scratch-part-3-general-user-anonymity-and-security.html

github.com

https://github.com/geeknik/the-nuclei-templates

gogilove.wordpress.com

https://gogilove.wordpress.com/2019/05/07/tor-onion-deep-web-faq/

httpoxy.org

https://httpoxy.org/

www.schneier.com

https://www.schneier.com/blog/archives/2023/01/the-fbi-identified-a-tor-user.html

www.theguardian.com

https://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document

wya.pl

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/

www.youtube.com

https://www.youtube.com/watch?v=v45_tkKCJ54

blog.munsiwoo.kr

https://blog.munsiwoo.kr/2023/03/blind-postgresql-injection-in-dapp-interface-20000-bounty/

fireshellsecurity.team

https://fireshellsecurity.team/sekaictf-frog-waf-and-chunky/#challenge-frog-waf-29-solves

github.com

https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040

portswigger.net

https://portswigger.net/research/browser-powered-desync-attacks

www.canva.dev

https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/

www.cisa.gov

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a

portswigger.net

https://portswigger.net/web-security/request-smuggling

www.synacktiv.com

https://www.synacktiv.com/en/publications/finding-a-pop-chain-on-a-common-symfony-bundle-part-1

blog.huli.tw

https://blog.huli.tw/2023/01/10/en/security-of-encrypt-or-hash-password-in-client-side/

blog.huli.tw

https://blog.huli.tw/2022/12/26/en/ctf-2022-web-js-summary/

blog.s1r1us.ninja

https://blog.s1r1us.ninja/CTF/site-isolation

gist.github.com

https://gist.github.com/parrot409/09688d0bb81acbe8cd1a10cfdaa59e45

onlydev.tistory.com

https://onlydev.tistory.com/157

auth0.com

https://auth0.com/blog/preventing-https-downgrade-attacks/

github.com

https://github.com/corelan/mona/blob/master/mona.py

github.com

https://github.com/jas502n/cve-2019-2618

matan-h.com

https://matan-h.com/one-lfi-bypass-to-rule-them-all-using-base64/

portswigger.net

https://portswigger.net/web-security/cross-site-scripting/contexts/lab-html-context-with-most-tags-and-attributes-blocked

portswigger.net

https://portswigger.net/research/exploiting-xss-in-hidden-inputs-and-meta-tags

sakurity.com

https://sakurity.com/blog/2015/03/15/authy_bypass.html

securitytrails.com

https://securitytrails.com/blog/jarm-fingerprinting-tool

www.youtube.com

https://www.youtube.com/watch?v=skbKjO8ahCI

devco.re

https://devco.re/blog/2023/07/07/a-journey-into-hacking-google-search-appliance-en/

www.wiz.io

https://www.wiz.io/blog/pyloose-first-python-based-fileless-attack-on-cloud-workloads

mohemiv.com

https://mohemiv.com/all/exploiting-xxe-with-local-dtd-files/

www.rcesecurity.com

https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/