Security Guides
Deep-dive playbooks, startup fundamentals, enterprise hardening.
Evilginx2 + AiTM Phishing: How Modern Attacks Defeat MFA
Adversary-in-the-Middle phishing captures both credentials and session cookies during auth flow — defeating traditional MFA. How AiTM works, detection limits, and why…
Red TeamingBrowser-in-the-Browser (BitB) Phishing: Why Users Still Fall for It
BitB renders fake browser popup windows inside the actual browser tab. Users see legitimate URLs in the fake popup and trust them.…
Security GuidesIndian Phishing in 2026: SMS, Vishing, and UPI Scams
The Indian phishing landscape has distinct shapes — SMS-led, mobile-first, UPI-integrated. Bank impersonation, KYC scams, UPI fraud patterns, vishing with AI voice…
Security GuidesEmail Security in 2026: SPF, DKIM, DMARC, MTA-STS, BIMI
The modern email-authentication stack — SPF for IP authorisation, DKIM for cryptographic signing, DMARC for enforcement and reporting, MTA-STS for TLS enforcement,…
Security GuidesGraphQL Authorisation Bypass: The Deep-Dive
GraphQL's most consequential bug class isn't injection — it's authorisation bypass. Field-level over-exposure, resolver-level IDOR, mutation field injection, connection traversal, batched-query tenant…
Security GuidesMaltego for OSINT: Graph-Based Investigation
Maltego turns scattered OSINT into structured intelligence. Entity types, transform ecosystem, practical workflow for phishing-campaign investigation, threat-actor profiling, supply-chain mapping. Pro vs…
Security GuidesIDOR: The Bug That Refuses to Die (And How to Find It)
IDOR is on half of Indian SaaS pentests. The taxonomy (sequential, UUID, path, body, header, mass assignment, indirect), the systematic test methodology…
Security GuidesOAuth 2.0 Attacks in 2026: Code Injection, PKCE Downgrade, JWT Issues
Modern OAuth attack surface — redirect URI manipulation, authorisation code injection, state parameter abuse, PKCE downgrade, JWT access token weaknesses, scope escalation.…
Security GuidesSAML Attacks: Golden SAML, XML Signature Wrapping, SLO Abuse
SAML attack surface in 2026 — XML Signature Wrapping (XSW1-8), Golden SAML (SolarWinds technique), signature exclusion, comment injection, audience replay, SLO abuse.…
Security GuidesXXE: External Entity Injection in 2026 — Where It Still Hides
XXE in 2026 — document upload (DOCX, SVG, RSS), SOAP APIs, SAML, RSS processors. Blind XXE via out-of-band channels, XXE-to-SSRF chains, and…