Ethical Hacking & Pentesting Blog
Technical articles on offensive cybersecurity, web hacking and CTF, written from real practice.
MCP Security: The New Weak Link in AI Agents
What the Model Context Protocol (MCP) is and why it became a new attack surface in 2026: tool poisoning, command injection, the year's CVEs and how to audit an MCP server.
Read article →
ClickFix and Fake CAPTCHAs: How They Convince You to Hack Yourself
What ClickFix is, the dominant initial access technique of 2026: the fake CAPTCHA that makes you paste a command and run the malware yourself, why it bypasses antivirus and EDR, its variants and how to defend.
Read article →
OAuth 2.0 and OIDC Attacks: The Flaws That Give Away Your Account
The most common failures of OAuth 2.0 and OIDC: weak validation of redirect_uri, problems with state, attacks against PKCE, theft and reuse of tokens, and modern security measures to prevent them.
Read article →
Deep Link and App Link Hijacking: How a Malicious App Steals Your Session
How a malicious app registers the same scheme as the legitimate one to intercept deep links and steal the OAuth code, the difference with verified App Links and Universal Links, and how to defend (including PKCE).
Read article →
Vibe Coding: Why AI-Generated Code Ships Full of Vulnerabilities
The 2026 data on the (in)security of AI-generated code: how often it fails, which vulnerabilities it introduces, the packages that do not exist, and how to work with AI without turning your code into a sieve.
Read article →
Dependency Confusion and Malicious Packages: The Supply Chain Attack
How typosquatting, dependency confusion and slopsquatting work on npm and PyPI, the real 2026 attacks and how to harden your pipeline.
Read article →
OWASP MAS: The Standard for Auditing Mobile Application Security
What OWASP MAS is and how to audit mobile apps with it: MASVS, MASWE and MASTG explained, the standard's categories and how to apply it on Android and iOS.
Read article →