Ep. 13 – nOAuth Account Misbinding & Assumed-Breach to Domain Admin (Season Finale)
One misbound identity. One exposed internal path. Two routes to total compromise. In this season finale of Hacked & Secured: Pentest Exploits & Mitigations, we break down two real-world findings that ...
29 Sep 202515min
Ep. 12 – Timing Attacks & Mobile OAuth Hijack: When Microseconds and Misflows Betray You
A few microseconds. One silent browser session. That’s all it took for attackers to break into systems without tripping a single alert. In this episode of Hacked & Secured: Pentest Exploits & Mitigati...
28 Aug 202514min
Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong
One flawed password reset. One shared session token. One dangerous object. In Episode 11 of Hacked & Secured: Pentest Exploits & Mitigations, we break down three real-world vulnerabilities where trust...
24 Juli 202517min
Ep. 10 – Cookie XSS & Image Upload RCE: One Cookie, One File, Full Control
One cookie set on a subdomain triggered XSS and stole session tokens. One fake image upload gave the attacker a reverse shell. This episode breaks down two powerful exploits—a cookie-based XSS that by...
26 Juni 202520min
Ep. 8 – OTP Flaw & Remote Code Execution: When Small Flaws Go Critical
A broken logout flow let attackers hijack accounts using just a user ID. A self-XSS and an IDOR exposed stored data. And a forgotten internal tool—running outdated software—ended in full Remote Code ...
24 Apr 202515min
Ep. 7 – IDOR & SSTI: From File Theft to Server-Side Secrets
A predictable ID exposed private documents. A crafted name leaked backend files. In this episode, we break down two high-impact flaws—an IDOR that let attackers clone confidential attachments, and an...
10 Apr 202519min
Ep. 6 – 403 Bypass & Request Smuggling: Tiny Tricks, Total Takeover
A single uppercase letter unlocked an admin panel. One malformed request hijacked user sessions. In this episode, we break down two real-world exploits—a 403 bypass and a request smuggling attack—tha...
27 Mars 202517min
