Ethical Hacking & Pentesting Blog
Technical articles on offensive cybersecurity, web hacking and CTF from real practice.
Deep Link and App Link Hijacking: How a Malicious App Steals Your Session
How a malicious app registers the same scheme as the legitimate one to intercept deep links and steal the OAuth code, the difference with verified App Links and Universal Links, and how to defend (including PKCE).
Read article →
Vibe Coding: Why AI-Generated Code Ships Full of Vulnerabilities
The 2026 data on the (in)security of AI-generated code: how often it fails, which vulnerabilities it introduces, the packages that do not exist, and how to work with AI without turning your code into a sieve.
Read article →
Dependency Confusion and Malicious Packages: The Supply Chain Attack
How typosquatting, dependency confusion and slopsquatting work on npm and PyPI, the real 2026 attacks and how to harden your pipeline.
Read article →
OWASP MAS: The Standard for Auditing Mobile Application Security
What OWASP MAS is and how to audit mobile apps with it: MASVS, MASWE and MASTG explained, the standard's categories and how to apply it on Android and iOS.
Read article →
Prompt injection: the new class of vulnerability (OWASP Top 10 LLM)
What prompt injection is and why it is the number one risk in AI applications: direct vs indirect, the OWASP Top 10 for LLMs and how to test and defend against it.
Read article →
AiTM Phishing: How the Second Factor Gets Bypassed (and Why MFA Is No Longer Enough)
What AiTM (adversary-in-the-middle) phishing is, how it steals the session to bypass MFA, why classic two-factor does not stop it and how to detect and defend against it.
Read article →
From 0 to Pentester in 2026: The Complete Roadmap to Start in Offensive Security
The real roadmap to become a pentester from scratch in 2026: fundamentals, web hacking, specialization and the role of AI. No shortcuts.
Read article →