Cache Poisoning: The Cache You Can't Purge
Cache poisoning tests aim at the edge because only the edge answers back. The inner caches behind one response, and why a cache buster buys nothing.
Blog
Write-ups on web application security: how each bug was found, what was tried before it worked, and what the fix turned out to be.
Client Side 03: DOM Clobbering
DOM clobbering turns named element references into overwritten globals, so HTML injection with no XSS is not a dead end. The bundler chains it breaks.
Hunting WebSockets: Bugs Behind 101 Switching Protocols
Most hunters close the tab at 101 Switching Protocols. A five-step WebSocket recipe, from broken authorization and IDOR to cross-site hijacking.
Auth for Hackers
Authentication for bug bounty hunters: sessions, cookie flags, JWTs, OAuth 2.0, OIDC and PKCE, and the auth gaps that lead to account takeover.
3 Bugs I Found One Hour Before Giving Up
A report generator missing ownership checks, CSS injection through a live cursor, and a Python sandbox that wasn't one. All found in the final hour.
How I Do Recon in 2026?
The recon chain that produces a spreadsheet of misconfigs is not recon. How to split a target into surfaces and read an application the way a hacker does.
Client Side 02: ServiceWorker Bugs
A Service Worker registered through a vulnerability lives in the victim's browser and outlives the patch. The lifecycle, the persistence, the hunt.
I Let AI Run My Recon Here's What It Found.
Recon eats time. What happened when Penligent was pointed at a target and left to map the attack surface, validate findings and produce a report unattended.
Claude Code For Hackers
Claude Code is everywhere in development, almost nowhere in security. Setting it up for hacking: project context, permissions, skills, real workflows.