// ethical hacking, plainly explained

Security you can actually apply.

Practical write-ups on AI security, web app testing, code review and DevSecOps, from someone who does the work.

Explore all guides Browse courses

					review: auth/login.php
					SQL injection
				
$email = $_POST['email'];
- $q = "SELECT * FROM users WHERE email='$email'";
+ $stmt = $pdo->prepare(
+   "SELECT * FROM users WHERE email = ?");
+ $stmt->execute([$email]);
$user = $stmt->fetch();

Browse by topic

Six areas, all written to be applied on real systems.

AI

LLM security, prompt injection and AI-assisted tooling.

Web Sec

OWASP Top 10, auth flaws and hardening real apps.

Pentest

Hands-on testing techniques for labs and authorised targets.

DevSecOps

Security checks wired into your CI/CD pipeline.

Code Review

Spotting vulnerabilities in real diffs, line by line.

Courses

Structured, hands-on learning paths.

Explore all guides

Latest write-ups

All AI Web Sec Pentest DevSecOps Code Review Courses

Web Sec

Cookie Theft via TLS Downgrade: Exploiting and Fixing Cryptographic Failures (OWASP A04:2025)

Use mitmproxy to steal a session cookie sent over plaintext HTTP, then fix it with HTTPS, Secure/HttpOnly/SameSite cookie flags, and…

October 7, 2026 · 10 min read

Web Sec

Catching a Rogue npm Package: Hands-On Software Supply Chain Security (OWASP A03:2025)

Build a Node.js project with a malicious postinstall script that exfiltrates a secret, then generate an SBOM, detect the rogue…

October 7, 2026 · 9 min read

Web Sec

Default Creds to Open Buckets: Hunting and Hardening Security Misconfigurations (OWASP A02:2025)

Scan a deliberately misconfigured Docker Compose stack with curl and nikto, then apply a hardened Nginx config and prove the…

October 7, 2026 · 11 min read

Web Sec

IDOR to Admin Takeover: Exploiting and Fixing Broken Access Control (OWASP A01:2025)

Walk through IDOR and forced-browsing exploits in a Flask notes app, then fix them with ownership checks and a role-required…

October 7, 2026 · 8 min read

AI

Securing AI Agents: Tool Allow-Lists, Scoped Credentials, Sandboxing and Audit Logs

Break a tool-calling agent with a hidden prompt injection in a local lab, then fix it with a deny-by-default tool…

October 6, 2026 · 11 min read

AI

AI Supply Chain Risk: Unsafe Model Files (Pickle) and Vetting Open-Source Libraries

A benign pickle payload proves that loading an untrusted model file can execute arbitrary code — then a picklescan +…

October 6, 2026 · 14 min read

AI

Prompt Injection Explained: Build a Vulnerable LLM App, Break It, Then Defend It

Build a small local assistant, break it with direct and indirect prompt injection (including markdown-image and tool-call exfiltration), then add…

October 6, 2026 · 21 min read

Pentest

PowerShell from Basics: Essential Commands

Learn PowerShell's object pipeline, Verb-Noun cmdlets, file, process and service commands, CSV/JSON export, and why execution policy is not security.

October 5, 2026 · 10 min read

Courses

What to look for in a practical pentesting course

Most “learn to hack” courses stop at tool usage. The ones worth your time teach you why a technique works,…

September 25, 2026 · 1 min read

// courses

Hands-on security courses are on the way.

Join the waitlist to hear when the first course opens.

Email address

// weekly roundup

One email a week with the security news that matters to builders.

A short roundup plus the newest tutorial. Unsubscribe any time.