Ethical Hacking & Pentesting Blog
Technical articles on offensive cybersecurity, web hacking and CTF, written from real practice.
Prompt injection: the new class of vulnerability (OWASP Top 10 LLM)
What prompt injection is and why it is the number one risk in AI applications: direct vs indirect, the OWASP Top 10 for LLMs and how to test and defend against it.
Read article →
AiTM Phishing: How the Second Factor Gets Bypassed (and Why MFA Is No Longer Enough)
What AiTM (adversary-in-the-middle) phishing is, how it steals the session to bypass MFA, why classic two-factor does not stop it and how to detect and defend against it.
Read article →
From 0 to Pentester in 2026: The Complete Roadmap to Start in Offensive Security
The real roadmap to become a pentester from scratch in 2026: fundamentals, web hacking, specialization and the role of AI. No shortcuts.
Read article →
Fraudulent Domains: Typosquatting and IDN Homograph Attacks
How phishing's fraudulent domains really work: typosquatting, combosquatting, bitsquatting and IDN homograph attacks. Detection and defense.
Read article →
MXS is here: mobile pentesting with your own APK and private domain
We've launched MXS, our new mobile pentesting certification. Learn to audit Android apps with your own lab: a unique APK and domain per student.
Read article →
This is how SixHack Academy courses work
Full breakdown of the WXJ and WXE course classroom: PDF theory manual, module-based videos, hands-on labs with dedicated Docker containers, discussion forum, and certification exam with built-in scheduler.
Read article →
Subdomain Takeover: Complete Technical Guide
Technical guide to subdomain takeover: what it is, how to detect dangling CNAMEs and how to exploit them across Azure, GitHub Pages, AWS S3, Heroku and other cloud services. Step-by-step PoC for each platform.
Read article →