All Blog Posts

Cybersecurity Articles

API authorization tests, Next.js security, and Burp lab notes. Technical posts with code and tests.

Android Pentest and Security Architecture: 2026 Field Manual and Source Code Analysis

A deep architectural analysis of Android application security: Binder IPC, Keystore/Keymint TEE integration, exported components, WebView exploits, JNI/NDK analysis, and Play Integrity mechanisms under 2026 standards.

Oct 06, 2026

14 min read

2,645 words

İS

ibrahimsql

Cybersecurity Engineer

Linux Reverse Engineering Anti-Debugging

Anti-Debugging for Noobs, Part 1: How a Program Notices the Debugger

First principles of anti-debugging on Linux: the one-tracer rule, ptrace self-trace, TracerPid in /proc, parent checks, timing gaps and 0xCC breakpoint scanning, plus how analysts answer each check.

Oct 06, 2026

15 min read

2,838 words

İS

ibrahimsql

Cybersecurity Engineer

iOS Pentest Mobile Security

iOS Pentesting Checklist: A Practical Verification Pass

Step-by-step iOS pentest flow: data storage, keychain, ATS, jailbreak detection, SSL pinning, Frida hooks and traffic inspection.

Oct 06, 2026

15 min read

2,844 words

İS

ibrahimsql

Cybersecurity Engineer

Linux Keylogging Input Subsystem

Keylogging on Linux, Part 1: From Kernel Key Handling to the X Server

How a key press travels through the kernel keyboard driver, the input subsystem, evdev and /dev/input/event nodes, then through the X server input pipeline and XKB keymap, and where loggers hook in.

Oct 06, 2026

48 min read

9,418 words

İS

ibrahimsql

Cybersecurity Engineer

Linux Wayland polkit

Security Architecture of Authorisation and Authentication UIs on the Linux Desktop

A deep architectural analysis of password prompts and permission dialogs on modern Linux: how Wayland, polkit, PAM, and xdg-desktop-portal isolate credentials and capabilities as of 2026.

Oct 06, 2026

20 min read

3,830 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Prototype Pollution Web Security

Featured

Prototype Pollution: Engine Internals, Node.js Gadget Chains, and Hardening Architecture

A deep technical dissection of JavaScript prototype pollution: V8 object shapes, server-side gadget chains in Node.js child_process and template engines, client-side DOM vectors, and strong runtime mitigations.

Oct 06, 2026

13 min read

2,587 words

İS

ibrahimsql

Cybersecurity Engineer

CVE OpenSSH Race Condition

Featured

regreSSHion Anatomy: Deep Dive into OpenSSH Pre-Auth RCE (CVE-2024-6387)

A deep architectural analysis of the OpenSSH pre-authentication remote code execution flaw (CVE-2024-6387): SIGALRM signal delivery, glibc ptmalloc reentrancy race conditions, heap grooming, and the 9.8p1 patch diff.

Oct 06, 2026

10 min read

1,806 words

İS

ibrahimsql

Cybersecurity Engineer

Wayland Linux Security Architecture

Wayland Compositor Security Architecture and Privileged Client Management

A deep architectural analysis of display server security: the input/output CIA triad, screencasting, input emulation (libei/EIS), session locking (ext-session-lock-v1), and sandbox isolation (security-context-v1) under 2026 standards.

Oct 06, 2026

20 min read

3,868 words

İS

ibrahimsql

Cybersecurity Engineer

Reverse Engineering Linux ELF

Featured

Modern Linux Binary Exploitation: Memory Layout, Compiler Mitigations, and Gadget Mechanics

An in-depth technical manual on x86_64 ELF memory corruption mechanics, compiler mitigations (Canaries, Full RELRO, PIE, Intel CET), sanitizer triage, and defensive binary engineering.

Oct 06, 2026

16 min read

3,101 words

İS

ibrahimsql

Cybersecurity Engineer

API Security IDOR Access Control

Turning the BOLA Test Matrix into Automation: Keeping Authorization as Endpoints Grow

Encoding the IDOR test matrix as code: a fixed set of role and tenant combinations that every new endpoint must pass before merging.

Oct 05, 2026

16 min read

3,186 words

İS

ibrahimsql

Cybersecurity Engineer

Burp Suite IDOR Access Control

Scanning the Access Matrix with Burp Intruder: A Repeatable Setup

Scanning the authorization matrix with two sessions and an ID list: recording a baseline, bulk requests with the attacker cookie, triage by length, single-request confirmation.

Oct 05, 2026

16 min read

3,047 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Defense Observability

Turning Denied Requests into Alerts: From Log to Triage

Deny logs become attack signal: alert record format, scanning patterns, threshold tuning, and a response card confirmed with a single request.

Oct 05, 2026

24 min read

4,636 words

İS

ibrahimsql

Cybersecurity Engineer

Next.js Authorization Server Actions

Authorization in Server Actions: Hiding the Button Is Not Protection

Next.js Server Actions are directly callable endpoints. A small policy pattern that moves the authorization check inside the action, plus how to test it.

Oct 05, 2026

14 min read

2,644 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Defense Authorization

Scoring Security Findings: An Impact-by-Reachability Table

CVSS alone lacks context: a practical prioritization table crossing data class and tenant breach with ease of access.

Oct 05, 2026

22 min read

4,337 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Defense Authorization

Security Logging: Who Accessed What, Decided How

Authorization decisions must be observable: an event schema recording actor, tenant, object, action, and policy decision, plus how to test it.

Oct 05, 2026

23 min read

4,589 words

İS

ibrahimsql

Cybersecurity Engineer

API Security Cybersecurity Defense

Shadow APIs and Asset Inventory: Mapping the Attack Surface

You cannot protect an endpoint you do not know: an inventory record format and coverage metric built from code, traffic, and DNS sources.

Oct 05, 2026

21 min read

4,081 words

İS

ibrahimsql

Cybersecurity Engineer

API Security Access Control IDOR

Featured

Your API Has Roles. That Does Not Mean Access Control Works

A practical test plan for object-level authorization, tenant isolation, and API access control bugs that survive happy-path role checks.

May 17, 2026

11 min read

2,060 words

İS

ibrahimsql

Cybersecurity Engineer

Next.js App Router Middleware

Noindex Is Not Auth: Protecting Private Pages in Next.js

How to separate link-only pages from truly private content in Next.js App Router using robots metadata, middleware, server actions, and HttpOnly cookies.

May 17, 2026

8 min read

1,589 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Reverse Engineering Tools

Featured

Metasploit Framework: Modules, Sessions, and Basic Workflows

Metasploit organized by task: choosing modules, handling sessions, and keeping notes during a test.

Nov 30, 2025

9 min read

1,788 words

İS

ibrahimsql

Cybersecurity Engineer

Burp Suite Web Security Tutorials

Featured

Burp Suite Proxy, Repeater, and Intruder: Intercepting and Replaying Web Requests

How Burp Suite Proxy, Repeater, and Intruder handle traffic interception and request replay, and where each fits in a manual web test.

Nov 29, 2025

10 min read

1,948 words

İS

ibrahimsql

Cybersecurity Engineer

Reverse Engineering Cybersecurity Tools

Wireshark: Capture Filters and Malicious Traffic Patterns

How to capture and analyze network traffic with Wireshark. Essential filters and techniques for spotting malicious activity.

Nov 29, 2025

11 min read

2,013 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Web Security Tutorials

OWASP Top 10: What Each Risk Category Covers

The ten OWASP risk categories summarized: from Broken Access Control to Injection, with prevention pointers.

Nov 28, 2025

11 min read

2,113 words

İS

ibrahimsql

Cybersecurity Engineer

Bug Bounty Tools Penetration Testing

Featured

A Small Bug Bounty Toolkit: What Each Tool Actually Does

Burp Suite, SQLmap, Shodan, and similar tools grouped by task: interception, enumeration, and verification in a manual test.

Nov 22, 2025

11 min read

2,149 words

İS

ibrahimsql

Cybersecurity Engineer

Mobile Security Linux Cybersecurity

Mobile App Testing Notes: APK Analysis, Jailbreak Detection, and Traffic Interception

Manual mobile test tasks: decompiling APKs, dealing with jailbreak and root detection, and intercepting TLS traffic.

Nov 20, 2025

11 min read

2,101 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Web Security Bug Bounty

WordPress Attack Surface: Plugins, Themes, and Core Misconfigurations

Where WordPress findings usually come from: plugin and theme flaws plus core misconfigurations, and how testers narrow that surface.

Nov 20, 2025

10 min read

1,986 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Cloud Security Pentesting

AWS Penetration Testing Notes: S3, IAM, and Lambda Misconfigurations

Common AWS findings: exposed S3 buckets, IAM misconfigurations, and Lambda weaknesses, grouped by service.

Nov 19, 2025

10 min read

1,970 words

İS

ibrahimsql

Cybersecurity Engineer

DevOps Cybersecurity Linux

Social Engineering: Phishing, Vishing, and Physical Breach Patterns

Recurring social-engineering patterns across phishing, vishing, and physical intrusion attempts.

Nov 17, 2025

11 min read

2,107 words

İS

ibrahimsql

Cybersecurity Engineer

Reverse Engineering Penetration Testing Linux

Featured

Penetration Testing Reading Order: Skills, Certifications, and Tools

A suggested study order for starting penetration testing: networking basics, security fundamentals, then practical labs.

Nov 01, 2025

10 min read

1,909 words

İS

ibrahimsql

Cybersecurity Engineer

XSS Web Security Bug Bounty

Featured

XSS Types Compared: Reflected, Stored, and DOM-Based Behavior

How reflected, stored, and DOM-based XSS differ in delivery and execution, with prevention notes tied to each type.

Oct 20, 2025

11 min read

2,102 words

İS

ibrahimsql

Cybersecurity Engineer

Web Security Penetration Testing Ethical Hacking

Featured

SQL Injection: Types, Manual Detection, and Parameterized Queries

In-band, blind, and out-of-band SQL injection compared, with manual detection notes and parameterized-query prevention.

Oct 15, 2025

10 min read

1,852 words

İS

ibrahimsql

Cybersecurity Engineer

Web Security Bug Bounty Cybersecurity

Featured

Web Hacking: Client-Side and Server-Side Vulnerability Classes

A map of web vulnerability classes, split by client-side and server-side, for planning what to study next.

Feb 15, 2025

11 min read

2,024 words

İS

ibrahimsql

Cybersecurity Engineer

Web Security Cybersecurity

Attacking Secondary Contexts in Web Applications

Secondary contexts testers check after the main flow: log files, admin panels, and background jobs.

Feb 10, 2025

12 min read

2,271 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity Web Security

Bypassing WAFs with Unicode Compatibility

When a WAF inspects input before Unicode normalization but the backend processes it after, compatibility characters can slip through.

Feb 05, 2025

10 min read

1,951 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity AI Automation

Featured

LLM-Assisted Security Testing: Payloads, Code Review, and Detection Notes

Where LLMs fit in a manual test: payload drafting, code review assistance, and detection support, with limits.

Jan 31, 2025

12 min read

2,203 words

İS

ibrahimsql

Cybersecurity Engineer

Cybersecurity AI Penetration Testing

Smart Contract Auditing: Reentrancy and Common Solidity Flaws

Solidity audit starting points: reentrancy and other frequent flaws, plus Slither and Mythril usage notes.

Jan 20, 2025

11 min read

2,130 words

İS

ibrahimsql

Cybersecurity Engineer

Reverse Engineering Cybersecurity

OWASP ZAP 2.16: New Features and Scan Comparison Notes

Notes on OWASP ZAP 2.16: new features, performance observations, and differences from paid scanners.

Jan 11, 2025

10 min read

1,871 words

İS

ibrahimsql

Cybersecurity Engineer

Automation API Security AI

Dead Link Detection: Subdomain Takeover and Phishing Risk

Broken links as attack surface: subdomain takeovers and phishing via dangling references, with automation notes.

Oct 20, 2024

12 min read

2,237 words

İS

ibrahimsql

Cybersecurity Engineer

XSS Cybersecurity Reverse Engineering

Zero-Interaction XSS: Payloads in Metadata, Filenames, and API Responses

XSS vectors that trigger without a click: metadata, filenames, and API responses rendering unsanitized content.

Jul 29, 2024

11 min read

2,189 words

İS

ibrahimsql

Cybersecurity Engineer

Follow new posts

No email newsletter; follow by RSS. Every new post lands here.

RSS Suggest a topic