LLM01: Prompt Injection
This is my running logbook for LLM01: Prompt Injection - the top entry in the OWASP Top 10 for LLM Applications (2026). One vulnerability class, lots of different disguises. Rather than write a separa
0xSebin - Sebin Thomas
OWASP Top 10 for LLM Applications (2026): A Beginner's Field Guide
Every company I look at these days has quietly wired a language model into something that matters. A support bot that can read the ticketing system. A coding copilot with access to the repo. An “ask o
Common Active Directory Misconfigurations and Where to Find Them
“You don’t need a zero-day. You just need to look harder.” Every time I drop into an internal network during a pentest or a red team engagement, the story is always the same - the domain is a goldmi
Gophish - Setting up without Evilginx - Part 2
GoPhish End-to-End Setup for Credential CaptureIn this second part, I will be configuring GoPhish from start to end, up to the point where we successfully capture the credentials of a phished user. Th
Gophish - Setting up without Evilginx - Part 1
Gophish Infrastructure Setup (EC2 · DNS · SMTP)This section covers the infrastructure-level setup required before deploying GoPhish. Proper configuration at this stage is critical to avoid blacklistin
Certified - Hack The Box
We began with the low-privileged user JUDITH.MADER@CERTIFIED.HTB, who had the ability to modify the owner of MANAGEMENT@CERTIFIED.HTB. By changing ownership, we added a controlled user to this group,
