How I Found Valid JavaScript Bugs? (Storytime)

CORS Misconfigurations: How Hackers Steal Your Cookies?

Mastering DOM XSS for Bug Bounties: DOM Invader & Bug Bounty Reports!

How to Find UNIQUE Subdomains (and Avoid Dupes)

AWS S3 Bucket Hacking Explained (Bug Bounty Hunters Must Watch)

Bug Bounty Guide: XXE Injection Explained with Real Reports

Report Writing Tips to Maximize Your Bounty

How to Discover High-Paying IDOR Bugs in Real Apps?

Bug Bounty Tip: Advanced GitHub Dorking for Maximum Results!

Don’t Sleep on Race Conditions – Easy Miss, Big Impact

Unboxing the Trap: The Dependency Confusion Hack🎙 Snake Bytes Ep. 5: Package Trap

Stop Ignoring These Business Logic Issues!

Hacking Blogs on Medium — Hits, Misses & WTF Moments

Train Your XSS Muscles With Me!

Exploiting Exact-match Cache Rules for Web Cache Deception | PortSwigger Lab | Explained

Grafana CVE-2025-4123: How XSS + Open Redirect Led to Full Account Takeover

Exploiting Cache Server Normalization for Web Cache Deception | PortSwigger Lab | Explained

How to Exploit Uncommon HTTP Headers for Hacking & Bug Bounties?

Mastering OAuth 2.0 Flows: Complete Guide + Security Testing Tips (Okta OAuth Playground)

Why Bug Bounty Hunters Still Check xmlrpc.php in 2025?

Exploiting Origin Server Normalization For Web Cache Deception | PortSwigger | Explained

Exploiting Path Delimiters for Web Cache Deception | PortSwigger Lab | Explained

Exploiting Path Mapping For Web Cache Deception | PortSwigger Lab | Explained

Web Cache Deception Made Simple – What You Need to Know!

You Asked, I Answered: Anonymous Q&A And My Reaction 😳

This Tiny Upload Flaw = Full RCE on Tomcat?! (CVE-2025-24813 Deep Dive)

GraphQL Attacks in the Wild: IDOR, SQLi & More | PART 2

How Bug Hunters Map GraphQL APIs? | PART 1

Bug Bounty Recon: Shadow APIs, Zombie Endpoints & How to Find Them?

Epic Infosec Week!

This Web Application is COOKED! Can we fix it?

Bug Bounty Hunters, Can You Beat This Quiz?

When 'Access Denied' Fails: Weird Authorization Bugs!

Explaining Random H1 Reports for 20 Minutes Straight!

Testing for Password Reset Poisoning in APIs – A Bug Hunter’s Guide

OWASP API Top 10 Breakdown | Study Session with CTF Challenges (DVAPI)

Authentication Bypass Via JKU Header Injection | JWT Hacking

Authentication Bypass Via JWK Header Injection | JWT Hacking

Subdomain Enumeration ALL KINDS!

Hunting Open Redirects: A Pathway to Chaining XSS

Unmasking the Ghost: The CWE-352 Dilemma🎙 Snake Bytes Ep. 4: Web Ghosts

Web Cache Poisoning: Hunting Methodology & Real-World Examples

The Danger of CWE-922 🎙 Snake Bytes Ep. 3: Data Dumpster

Loose Locks: A Podcast with _smile_hacker_ 🎙 : Snake Bytes Ep. 2

How Missing Keys Leave Your Castle Open🎙 Snake Bytes Ep. 1: Barrier Bypass

How To Exploit SSRF To Fetch AWS Credentials

OWASP API Top 10 - Broken Authentication

XSS Using Indirect Prompt Injection | PART 5

LLM API Hacking | Indirect Prompt Injection in LLM APIs | PART 4

LLM API Hacking | OS Command Injection in LLM APIs | PART 3

LLM API Hacking | Excessive Agency | PART 2

LLM API Hacking | Introduction | PART 1

HTTP Parameter Pollution VS Mass Assignment

IDOR In Shopify GraphQL API | Report Explained

Server-Side Parameter Pollution in REST APIs

Exploring Server-Side Parameter Pollution: Real Case Scenario, Parameter Precedence, and More!

Performing CSRF exploits over GraphQL

Bypassing GraphQL Brute-Force Protections

Finding a Hidden GraphQL Endpoint

Accidental Exposure of Private GraphQL Fields