[{"data":1,"prerenderedAt":81},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"blog-page-2":33},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"posts":34,"total":80},[35,40,45,50,55,60,65,70,75],{"title":36,"description":37,"slug":38,"coverImage":39},"AI Just Made Bug Bounty Way Easier","Feeding an open-source target's own source code to an AI assistant, with a local and VPS setup, so you stop guessing how your input is handled.","ai-just-made-bug-bounty-way-easier","\u002Fimages\u002Fblog\u002Fai-just-made-bug-bounty-way-easier\u002Fai-just-made-bug-bounty-way-easier-copy.webp",{"title":41,"description":42,"slug":43,"coverImage":44},"Client Side 01: postMessage Bugs","postMessage bugs sit unnoticed in checkout pages, auth flows and chat widgets. Origins, senders, receivers, sinks, and the mistakes that expose them.","client-side-01-postmessage-bugs","\u002Fimages\u002Fblog\u002Fclient-side-01-postmessage-bugs\u002Fclient-side-01-postmessage-exploits-copy.webp",{"title":46,"description":47,"slug":48,"coverImage":49},"SSTI From Input To RCE","Server-side template injection from first principles: how template engines work, where they break, and Jinja2 exploitation from input to RCE.","ssti-from-input-to-rce","\u002Fimages\u002Fblog\u002Fssti-from-input-to-rce\u002Fssti-from-input-to-rce.webp",{"title":51,"description":52,"slug":53,"coverImage":54},"The Bug Bounty Report Blueprint Triagers Don’t Ignore","A real vulnerability still gets rejected if the report fails to tell the story. The anatomy of a report triagers act on, section by section.","the-bug-bounty-report-blueprint-triagers-dont-ignore","\u002Fimages\u002Fblog\u002Fthe-bug-bounty-report-blueprint-triagers-dont-ignore\u002Fthe-bug-bounty-report-blueprint.webp",{"title":56,"description":57,"slug":58,"coverImage":59},"GraphQL for Bug Bounty Hunters","How GraphQL really works and why its flexibility is a goldmine: schemas, queries, mutations, fragments, and testing an endpoint like an attacker.","graphql-for-bug-bounty-hunters","\u002Fimages\u002Fblog\u002Fgraphql-for-bug-bounty-hunters\u002Fgraphql-for-bug-bounty-hunters.webp",{"title":61,"description":62,"slug":63,"coverImage":64},"Deploy Your Next Hacking Lab in 30 Seconds","Three ways to deploy a vulnerable web app lab: manual Docker commands, Docker Compose, and a visual Compose manager that removes the command line entirely.","deploy-your-next-hacking-lab-in-30-seconds","\u002Fimages\u002Fblog\u002Fdeploy-your-next-hacking-lab-in-30-seconds\u002Fdeploy-your-next-hacking-lab-in-30-seconds.webp",{"title":66,"description":67,"slug":68,"coverImage":69},"3 Tricks to Hunt Faster in Bug Bounty","Three small workflow changes that remove friction from a hunt: proxy match-and-replace rules, repeatable workflows, and a fast note-taking system.","3-tricks-to-hunt-faster-in-bug-bounty","\u002Fimages\u002Fblog\u002F3-tricks-to-hunt-faster-in-bug-bounty\u002F3-tricks-to-hunt-faster-in-bug-bounty.webp",{"title":71,"description":72,"slug":73,"coverImage":74},"The TrashCash | Turning Deleted Files Into Bounties","TrashCash: restoring deleted files from Git history to recover the secrets developers thought they wiped. The biggest payouts aren't always payloads.","the-trashcash-turning-deleted-files-into-bounties","\u002Fimages\u002Fblog\u002Fthe-trashcash-turning-deleted-files-into-bounties\u002Fthe-trashcash-turning-deleted-files-into-bountie.webp",{"title":76,"description":77,"slug":78,"coverImage":79},"How I Found IDORs That Shouldn’t Exist","IDORs that survive modern access control: trailing slashes, path normalisation, double slashes and obfuscated paths, with testable examples.","how-i-found-idors-that-shouldnt-exist","\u002Fimages\u002Fblog\u002Fhow-i-found-idors-that-shouldnt-exist\u002Fhow-i-found-idors-that-shouldnt-exist.webp",68,1791941255422]