Security

Cybersecurity research, penetration testing, and vulnerability analysis

Posts

Android Pentest and Security Architecture: 2026 Field Manual and Source Code Analysis

A deep architectural analysis of Android application security: Binder IPC, Keystore/Keymint TEE integration, exported components, WebView exploits, JNI/NDK analysis, and Play Integrity mechanisms under 2026 standards.

Oct 06, 2026

14 min read

2,645 words

İS

ibrahimsql

Cybersecurity Engineer

Linux Reverse Engineering Anti-Debugging

Anti-Debugging for Noobs, Part 1: How a Program Notices the Debugger

First principles of anti-debugging on Linux: the one-tracer rule, ptrace self-trace, TracerPid in /proc, parent checks, timing gaps and 0xCC breakpoint scanning, plus how analysts answer each check.

Oct 06, 2026

15 min read

2,838 words

İS

ibrahimsql

Cybersecurity Engineer

iOS Pentest Mobile Security

iOS Pentesting Checklist: A Practical Verification Pass

Step-by-step iOS pentest flow: data storage, keychain, ATS, jailbreak detection, SSL pinning, Frida hooks and traffic inspection.

Oct 06, 2026

15 min read

2,844 words

İS

ibrahimsql

Cybersecurity Engineer

Linux Keylogging Input Subsystem

Keylogging on Linux, Part 1: From Kernel Key Handling to the X Server

How a key press travels through the kernel keyboard driver, the input subsystem, evdev and /dev/input/event nodes, then through the X server input pipeline and XKB keymap, and where loggers hook in.

Oct 06, 2026

48 min read

9,418 words

İS

ibrahimsql

Cybersecurity Engineer

Linux Wayland polkit

Security Architecture of Authorisation and Authentication UIs on the Linux Desktop

A deep architectural analysis of password prompts and permission dialogs on modern Linux: how Wayland, polkit, PAM, and xdg-desktop-portal isolate credentials and capabilities as of 2026.

Oct 06, 2026

20 min read

3,830 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Prototype Pollution Web Security

Featured

Prototype Pollution: Engine Internals, Node.js Gadget Chains, and Hardening Architecture

A deep technical dissection of JavaScript prototype pollution: V8 object shapes, server-side gadget chains in Node.js child_process and template engines, client-side DOM vectors, and strong runtime mitigations.

Oct 06, 2026

13 min read

2,587 words

İS

ibrahimsql

Cybersecurity Engineer

CVE OpenSSH Race Condition

Featured

regreSSHion Anatomy: Deep Dive into OpenSSH Pre-Auth RCE (CVE-2024-6387)

A deep architectural analysis of the OpenSSH pre-authentication remote code execution flaw (CVE-2024-6387): SIGALRM signal delivery, glibc ptmalloc reentrancy race conditions, heap grooming, and the 9.8p1 patch diff.

Oct 06, 2026

10 min read

1,806 words

İS

ibrahimsql

Cybersecurity Engineer

Wayland Linux Security Architecture

Wayland Compositor Security Architecture and Privileged Client Management

A deep architectural analysis of display server security: the input/output CIA triad, screencasting, input emulation (libei/EIS), session locking (ext-session-lock-v1), and sandbox isolation (security-context-v1) under 2026 standards.

Oct 06, 2026

20 min read

3,868 words

İS

ibrahimsql

Cybersecurity Engineer

Reverse Engineering Linux ELF

Featured

Modern Linux Binary Exploitation: Memory Layout, Compiler Mitigations, and Gadget Mechanics

An in-depth technical manual on x86_64 ELF memory corruption mechanics, compiler mitigations (Canaries, Full RELRO, PIE, Intel CET), sanitizer triage, and defensive binary engineering.

Oct 06, 2026

16 min read

3,101 words

İS

ibrahimsql

Cybersecurity Engineer

API Security IDOR Access Control

Turning the BOLA Test Matrix into Automation: Keeping Authorization as Endpoints Grow

Encoding the IDOR test matrix as code: a fixed set of role and tenant combinations that every new endpoint must pass before merging.

Oct 05, 2026

16 min read

3,186 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Defense Observability

Turning Denied Requests into Alerts: From Log to Triage

Deny logs become attack signal: alert record format, scanning patterns, threshold tuning, and a response card confirmed with a single request.

Oct 05, 2026

24 min read

4,636 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Defense Authorization

Scoring Security Findings: An Impact-by-Reachability Table

CVSS alone lacks context: a practical prioritization table crossing data class and tenant breach with ease of access.

Oct 05, 2026

22 min read

4,337 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Defense Authorization

Security Logging: Who Accessed What, Decided How

Authorization decisions must be observable: an event schema recording actor, tenant, object, action, and policy decision, plus how to test it.

Oct 05, 2026

23 min read

4,589 words

İS

ibrahimsql

Cybersecurity Engineer

API Security Cybersecurity Defense

Shadow APIs and Asset Inventory: Mapping the Attack Surface

You cannot protect an endpoint you do not know: an inventory record format and coverage metric built from code, traffic, and DNS sources.

Oct 05, 2026

21 min read

4,081 words

İS

ibrahimsql

Cybersecurity Engineer

API Security Access Control IDOR

Featured

Your API Has Roles. That Does Not Mean Access Control Works

A practical test plan for object-level authorization, tenant isolation, and API access control bugs that survive happy-path role checks.

May 17, 2026

11 min read

2,060 words

İS

ibrahimsql

Cybersecurity Engineer

Mobile Security Linux Cybersecurity

Mobile App Testing Notes: APK Analysis, Jailbreak Detection, and Traffic Interception

Manual mobile test tasks: decompiling APKs, dealing with jailbreak and root detection, and intercepting TLS traffic.

Nov 20, 2025

11 min read

2,101 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Web Security Bug Bounty

WordPress Attack Surface: Plugins, Themes, and Core Misconfigurations

Where WordPress findings usually come from: plugin and theme flaws plus core misconfigurations, and how testers narrow that surface.

Nov 20, 2025

10 min read

1,986 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Cloud Security Pentesting

AWS Penetration Testing Notes: S3, IAM, and Lambda Misconfigurations

Common AWS findings: exposed S3 buckets, IAM misconfigurations, and Lambda weaknesses, grouped by service.

Nov 19, 2025

10 min read

1,970 words

İS

ibrahimsql

Cybersecurity Engineer

DevOps Cybersecurity Linux

Social Engineering: Phishing, Vishing, and Physical Breach Patterns

Recurring social-engineering patterns across phishing, vishing, and physical intrusion attempts.

Nov 17, 2025

11 min read

2,107 words

İS

ibrahimsql

Cybersecurity Engineer

Reverse Engineering Penetration Testing Linux

Featured

Penetration Testing Reading Order: Skills, Certifications, and Tools

A suggested study order for starting penetration testing: networking basics, security fundamentals, then practical labs.

Nov 01, 2025

10 min read

1,909 words

İS

ibrahimsql

Cybersecurity Engineer

XSS Web Security Bug Bounty

Featured

XSS Types Compared: Reflected, Stored, and DOM-Based Behavior

How reflected, stored, and DOM-based XSS differ in delivery and execution, with prevention notes tied to each type.

Oct 20, 2025

11 min read

2,102 words

İS

ibrahimsql

Cybersecurity Engineer

Web Security Penetration Testing Ethical Hacking

Featured

SQL Injection: Types, Manual Detection, and Parameterized Queries

In-band, blind, and out-of-band SQL injection compared, with manual detection notes and parameterized-query prevention.

Oct 15, 2025

10 min read

1,852 words

İS

ibrahimsql

Cybersecurity Engineer

Web Security Bug Bounty Cybersecurity

Featured

Web Hacking: Client-Side and Server-Side Vulnerability Classes

A map of web vulnerability classes, split by client-side and server-side, for planning what to study next.

Feb 15, 2025

11 min read

2,024 words

İS

ibrahimsql

Cybersecurity Engineer

Web Security Cybersecurity

Attacking Secondary Contexts in Web Applications

Secondary contexts testers check after the main flow: log files, admin panels, and background jobs.

Feb 10, 2025

12 min read

2,271 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Web Security

Bypassing WAFs with Unicode Compatibility

When a WAF inspects input before Unicode normalization but the backend processes it after, compatibility characters can slip through.

Feb 05, 2025

10 min read

1,951 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity AI Automation

Featured

LLM-Assisted Security Testing: Payloads, Code Review, and Detection Notes

Where LLMs fit in a manual test: payload drafting, code review assistance, and detection support, with limits.

Jan 31, 2025

12 min read

2,203 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity AI Penetration Testing

Smart Contract Auditing: Reentrancy and Common Solidity Flaws

Solidity audit starting points: reentrancy and other frequent flaws, plus Slither and Mythril usage notes.

Jan 20, 2025

11 min read

2,130 words

İS

ibrahimsql

Cybersecurity Engineer

Reverse Engineering Cybersecurity

OWASP ZAP 2.16: New Features and Scan Comparison Notes

Notes on OWASP ZAP 2.16: new features, performance observations, and differences from paid scanners.

Jan 11, 2025

10 min read

1,871 words

İS

ibrahimsql

Cybersecurity Engineer

Automation API Security AI

Dead Link Detection: Subdomain Takeover and Phishing Risk

Broken links as attack surface: subdomain takeovers and phishing via dangling references, with automation notes.

Oct 20, 2024

12 min read

2,237 words

İS

ibrahimsql

Cybersecurity Engineer

XSS Cybersecurity Reverse Engineering

Zero-Interaction XSS: Payloads in Metadata, Filenames, and API Responses

XSS vectors that trigger without a click: metadata, filenames, and API responses rendering unsanitized content.

Jul 29, 2024

11 min read

2,189 words

İS

ibrahimsql

Cybersecurity Engineer

Security

Android Pentest and Security Architecture: 2026 Field Manual and Source Code Analysis

Anti-Debugging for Noobs, Part 1: How a Program Notices the Debugger

iOS Pentesting Checklist: A Practical Verification Pass

Keylogging on Linux, Part 1: From Kernel Key Handling to the X Server

Security Architecture of Authorisation and Authentication UIs on the Linux Desktop

Prototype Pollution: Engine Internals, Node.js Gadget Chains, and Hardening Architecture

regreSSHion Anatomy: Deep Dive into OpenSSH Pre-Auth RCE (CVE-2024-6387)

Wayland Compositor Security Architecture and Privileged Client Management

Modern Linux Binary Exploitation: Memory Layout, Compiler Mitigations, and Gadget Mechanics

Turning the BOLA Test Matrix into Automation: Keeping Authorization as Endpoints Grow

Turning Denied Requests into Alerts: From Log to Triage

Scoring Security Findings: An Impact-by-Reachability Table

Security Logging: Who Accessed What, Decided How

Shadow APIs and Asset Inventory: Mapping the Attack Surface

Your API Has Roles. That Does Not Mean Access Control Works

Mobile App Testing Notes: APK Analysis, Jailbreak Detection, and Traffic Interception

WordPress Attack Surface: Plugins, Themes, and Core Misconfigurations

AWS Penetration Testing Notes: S3, IAM, and Lambda Misconfigurations

Social Engineering: Phishing, Vishing, and Physical Breach Patterns

Penetration Testing Reading Order: Skills, Certifications, and Tools

XSS Types Compared: Reflected, Stored, and DOM-Based Behavior

SQL Injection: Types, Manual Detection, and Parameterized Queries

Web Hacking: Client-Side and Server-Side Vulnerability Classes

Attacking Secondary Contexts in Web Applications

Bypassing WAFs with Unicode Compatibility

LLM-Assisted Security Testing: Payloads, Code Review, and Detection Notes

Smart Contract Auditing: Reentrancy and Common Solidity Flaws

OWASP ZAP 2.16: New Features and Scan Comparison Notes

Dead Link Detection: Subdomain Takeover and Phishing Risk

Zero-Interaction XSS: Payloads in Metadata, Filenames, and API Responses

Explore Other Categories

Development

Tutorials

Tools