DevSecOps
Slopsquatting: When Your AI Assistant Invents a Dependency, and the CI Gate That Stops It
AI assistants repeatedly invent package names that anyone can register; build a local registry lab, watch a vulnerable CI pipeline…
All posts
Every guide on dhacker.in, newest first. Pick a category to narrow it down.
DevSecOps
When the Issue Tracker Gives Orders: Prompt Injection Against AI Agents in CI/CD
A triage bot that pastes issue text into its prompt can be steered by an attacker who only has permission…
Courses
OWASP Top 10:2025 — The Hands-On Course
Ten modules, ten Docker labs. Exploit and fix every category in the OWASP Top 10:2025 yourself, on your own machine.
Web Sec
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Verify, Detect and Patch the PHP Worker RCE Pair
Two critical PHP flaws in request-memory handling were fixed on 2026-10-21; this lab shows how to verify your version, try…
Web Sec
Stack Traces, Stuck Locks, and Stolen Funds: When Error Handling Is the Vulnerability (OWASP A10:2025)
Build a Flask app that leaks a processing-slot lock and a stack trace on unhandled exceptions, exploit both into a…
Web Sec
Silent Brute Force: Building Detection When Your Logs Say Nothing (OWASP A09:2025)
Build a Flask login app with no logging, watch a brute-force attack vanish without a trace, then add structured JSON…
Web Sec
RCE via Pickle: Exploiting Insecure Deserialization and Restoring Data Integrity (OWASP A08:2025)
Build a Flask app vulnerable to pickle.loads() RCE, craft a working __reduce__ exploit, then fix it with JSON schema validation…
Web Sec
Credential Stuffing a Login Page: Breaking and Defending Authentication (OWASP A07:2025)
Build a Flask login app, break it with a credential-stuffing script, then fix it with Flask-Limiter, a breached-password check, and…
Web Sec
Buying Out the House: Exploiting Business-Logic Flaws in Insecure Designs (OWASP A06:2025)
Build a Flask ticket-booking app with no server-side purchase cap and a brute-forceable security-question reset, exploit both, then fix them…
Web Sec
From SQLi to OS Command Injection: Exploiting and Patching Injection Flaws (OWASP A05:2025)
Build a Flask app with a raw-SQL login and an unsafe ping-host tool, exploit both with SQL injection and OS…