2026-09-20 4 min
[notes]
Mobile Application Attack Surface: Android and iOS
Manifest and exported components, deep links and app links, WebView bridges, Keychain and Keystore, pinning and mobile API authentication.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-09-20 3 min
[notes]
ML Infrastructure and Model Supply Chain
Jupyter, MLflow tracking servers, GPU nodes and schedulers, MLOps trust boundaries and model weights that are also executable software.
2026-09-20 4 min
[notes]
Prompt Injection and LLM Application Security
Untrusted text that gains authority, indirect injection, tool calling versus authorization, retrieval poisoning and MCP authorization in depth.
2026-09-20 3 min
[notes]
WebSockets, gRPC and GraphQL Authorization
Persistent connections few teams review, protobuf and reflection, and persisted queries: what authorization looks like after the handshake or the hash.
2026-09-20 3 min
[notes]
API Authorization: BOLA, BFLA and Mass Assignment
Object and function level authorization, fields the client should never control, deprecated versions still running and what an OpenAPI schema does not prove.