Web Sec
Cookie Theft via TLS Downgrade: Exploiting and Fixing Cryptographic Failures (OWASP A04:2025)
Use mitmproxy to steal a session cookie sent over plaintext HTTP, then fix it with HTTPS, Secure/HttpOnly/SameSite cookie flags, and…
All posts
Every guide on dhacker.in, newest first. Pick a category to narrow it down.
Web Sec
Catching a Rogue npm Package: Hands-On Software Supply Chain Security (OWASP A03:2025)
Build a Node.js project with a malicious postinstall script that exfiltrates a secret, then generate an SBOM, detect the rogue…
Web Sec
Default Creds to Open Buckets: Hunting and Hardening Security Misconfigurations (OWASP A02:2025)
Scan a deliberately misconfigured Docker Compose stack with curl and nikto, then apply a hardened Nginx config and prove the…
Web Sec
IDOR to Admin Takeover: Exploiting and Fixing Broken Access Control (OWASP A01:2025)
Walk through IDOR and forced-browsing exploits in a Flask notes app, then fix them with ownership checks and a role-required…
AI
Securing AI Agents: Tool Allow-Lists, Scoped Credentials, Sandboxing and Audit Logs
Break a tool-calling agent with a hidden prompt injection in a local lab, then fix it with a deny-by-default tool…
AI
AI Supply Chain Risk: Unsafe Model Files (Pickle) and Vetting Open-Source Libraries
A benign pickle payload proves that loading an untrusted model file can execute arbitrary code — then a picklescan +…
AI
Prompt Injection Explained: Build a Vulnerable LLM App, Break It, Then Defend It
Build a small local assistant, break it with direct and indirect prompt injection (including markdown-image and tool-call exfiltration), then add…
Pentest
PowerShell from Basics: Essential Commands
Learn PowerShell's object pipeline, Verb-Noun cmdlets, file, process and service commands, CSV/JSON export, and why execution policy is not security.
Courses
What to look for in a practical pentesting course
Most “learn to hack” courses stop at tool usage. The ones worth your time teach you why a technique works,…
Exploits
Anatomy of a server-side request forgery exploit
SSRF turns a server into an unwilling proxy for the attacker. The classic target is internal metadata endpoints that were…