[{"data":1,"prerenderedAt":100},["ShallowReactive",2],{"i-tabler:sun":3,"i-tabler:moon":8,"i-tabler:menu-2":10,"i-tabler:x":12,"i-simple-icons:youtube":14,"i-simple-icons:github":16,"i-simple-icons:x":18,"i-simple-icons:linkedin":20,"announcement":23,"i-tabler:arrow-up-right":31,"home-latest":33,"i-tabler:eye":94,"i-tabler:clock":96,"i-tabler:calendar":98},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":21,"hidden":22},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"startsAt":24,"endsAt":25,"scramble":26,"cta":27,"message":30},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":28,"label":29},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",[34,39,44,49,54,59,64,69,74,79,84,89],{"title":35,"description":36,"slug":37,"coverImage":38,"noindex":6},"Cache Poisoning: The Cache You Can't Purge","Cache poisoning tests aim at the edge because only the edge answers back. The inner caches behind one response, and why a cache buster buys nothing.","cache-poisoning-the-cache-you-cant-purge","\u002Fimages\u002Fblog\u002Fcache-poisoning-the-cache-you-cant-purge\u002Fcache-poisoning.webp",{"title":40,"description":41,"slug":42,"coverImage":43,"noindex":6},"Client Side 03: DOM Clobbering","DOM clobbering turns named element references into overwritten globals, so HTML injection with no XSS is not a dead end. The bundler chains it breaks.","client-side-03-dom-clobbering","\u002Fimages\u002Fblog\u002Fclient-side-03-dom-clobbering\u002Fclient-side-03-dom-clobbering.webp",{"title":45,"description":46,"slug":47,"coverImage":48,"noindex":6},"Hunting WebSockets: Bugs Behind 101 Switching Protocols","Most hunters close the tab at 101 Switching Protocols. A five-step WebSocket recipe, from broken authorization and IDOR to cross-site hijacking.","hunting-websockets-bugs-behind-101-switching-protocols","\u002Fimages\u002Fblog\u002Fhunting-websockets-bugs-behind-101-switching-protocols\u002Fhunting-websockets.webp",{"title":50,"description":51,"slug":52,"coverImage":53,"noindex":6},"Auth for Hackers","Authentication for bug bounty hunters: sessions, cookie flags, JWTs, OAuth 2.0, OIDC and PKCE, and the auth gaps that lead to account takeover.","auth-for-hackers","\u002Fimages\u002Fblog\u002Fauth-for-hackers\u002Fauth-for-hackers-pt1.webp",{"title":55,"description":56,"slug":57,"coverImage":58,"noindex":6},"3 Bugs I Found One Hour Before Giving Up","A report generator missing ownership checks, CSS injection through a live cursor, and a Python sandbox that wasn't one. All found in the final hour.","3-bugs-i-found-one-hour-before-giving-up","\u002Fimages\u002Fblog\u002F3-bugs-i-found-one-hour-before-giving-up\u002F3-bugs-i-found-one-hour-before-giving-up.webp",{"title":60,"description":61,"slug":62,"coverImage":63,"noindex":6},"How I Do Recon in 2026?","The recon chain that produces a spreadsheet of misconfigs is not recon. How to split a target into surfaces and read an application the way a hacker does.","how-i-do-recon-in-2026","\u002Fimages\u002Fblog\u002Fhow-i-do-recon-in-2026\u002Fhow-i-do-recon-in-2026.webp",{"title":65,"description":66,"slug":67,"coverImage":68,"noindex":6},"Client Side 02: ServiceWorker Bugs","A Service Worker registered through a vulnerability lives in the victim's browser and outlives the patch. The lifecycle, the persistence, the hunt.","client-side-02-serviceworker-bugs","\u002Fimages\u002Fblog\u002Fclient-side-02-serviceworker-bugs\u002Fclient-side-02-serviceworker-bugs-copy.webp",{"title":70,"description":71,"slug":72,"coverImage":73,"noindex":6},"I Let AI Run My Recon Here's What It Found.","Recon eats time. What happened when Penligent was pointed at a target and left to map the attack surface, validate findings and produce a report unattended.","i-let-ai-run-my-recon-heres-what-it-found","\u002Fimages\u002Fblog\u002Fi-let-ai-run-my-recon-heres-what-it-found\u002Filetairunmyreconhereswhatitfound.webp",{"title":75,"description":76,"slug":77,"coverImage":78,"noindex":6},"Claude Code For Hackers","Claude Code is everywhere in development, almost nowhere in security. Setting it up for hacking: project context, permissions, skills, real workflows.","claude-code-for-hackers","\u002Fimages\u002Fblog\u002Fclaude-code-for-hackers\u002Fclaudecodeforhackers-copy.webp",{"title":80,"description":81,"slug":82,"coverImage":83,"noindex":6},"AI Just Made Bug Bounty Way Easier","Feeding an open-source target's own source code to an AI assistant, with a local and VPS setup, so you stop guessing how your input is handled.","ai-just-made-bug-bounty-way-easier","\u002Fimages\u002Fblog\u002Fai-just-made-bug-bounty-way-easier\u002Fai-just-made-bug-bounty-way-easier-copy.webp",{"title":85,"description":86,"slug":87,"coverImage":88,"noindex":6},"Client Side 01: postMessage Bugs","postMessage bugs sit unnoticed in checkout pages, auth flows and chat widgets. Origins, senders, receivers, sinks, and the mistakes that expose them.","client-side-01-postmessage-bugs","\u002Fimages\u002Fblog\u002Fclient-side-01-postmessage-bugs\u002Fclient-side-01-postmessage-exploits-copy.webp",{"title":90,"description":91,"slug":92,"coverImage":93,"noindex":6},"SSTI From Input To RCE","Server-side template injection from first principles: how template engines work, where they break, and Jinja2 exploitation from input to RCE.","ssti-from-input-to-rce","\u002Fimages\u002Fblog\u002Fssti-from-input-to-rce\u002Fssti-from-input-to-rce.webp",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":95},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M10 12a2 2 0 1 0 4 0a2 2 0 0 0-4 0\"\u002F>\u003Cpath d=\"M21 12q-3.6 6-9 6t-9-6q3.6-6 9-6t9 6\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":97},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 0 0-18 0\"\u002F>\u003Cpath d=\"M12 7v5l3 3\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":99},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",1791942278776]