-
Sync – Vulnlab and Hack The Box Walkthrough
Ready to crack the Sync machine? Whether you are tackling it on Vulnlab or grinding through Hack The Box, this detailed penetration testing walkthrough covers the exact path from foot-hold to flag. Learn how to use Nmap to discover the file synchronization daemon, audit the target for insecure anonymous connection profiles, enumerate hidden file shares…
-
Prompt Injection Attack Guide and Cheat Sheet
Master the art of LLM red teaming with this comprehensive prompt injection attack guide and cheat sheet. We break down the mechanics of both direct and indirect prompt injections, explore advanced jailbreaking techniques, and provide a repository of field-tested bypass payloads. Whether you are auditing enterprise AI applications or prepping for an upcoming web application…
-
HTB Certified Web Exploitation Specialist (CWES) – Certification, Exam and Training Review (Hack The Box)
In this comprehensive review, I pull back the curtain on the intense training path and practical exam. I break down the depth of the lab challenges, evaluate the real-world lab environments, analyze the exam difficulty, and share actionable preparation strategies to help you earn this elite web penetration testing specialist title.
-
Practical Web Pentest Professional (PWPP) Certification, Exam and Training Review
Is the Practical Web Pentest Professional (PWPP) certification from TCM Security worth your time? In this in-depth review, I break down my experience navigating the training material and taking the hands-on practical exam. Discover how this course bridges the gap for intermediate web app penetration testers, what the reporting requirements look like, and key strategies…
-
How to Crush Web App Penetration Tests
Stop guessing and start hunting. The difference between missing a critical vulnerability and finding a high-impact exploit chain comes down to having a repeatable, airtight attack plan. In this guide, I lay out my exact, battle-tested web application penetration testing methodology. From initial enumeration and mapping out business logic to identifying weak parameters, bypassing filters,…
-
My BSides SF 2025 Experience
I recently attended the 2-day BSides SF 2025 conference at the San Francisco Metreon and wanted to share my experience at the event. This was also my first time attending BSides in San Francisco and I wanted to thank everyone that I met during the conference, especially the panelists at all the talks and the…
