Stay Sharp.
Hack Smarter.
Real offensive security techniques for pentesters, bug bounty hunters, and OSCP aspirants. No fluff. Just actionable knowledge.
What You'll Get
No endless payloads. Just practical tactics you'll actually use when auditing real systems. Each week, get actionable insights from real offensive security work.
Real-World Techniques
Tactics you'll remember and reuse in actual pentests and CTFs
Tools & Tactics
Latest tools, hacker mindset, and methodology breakdowns
Multi-Domain Coverage
Web2/Web3, mobile hacking, Active Directory, and more
Sunday Security Drops
Weekly newsletter delivered every Sunday to your inbox
Join the Community
Subscribe and level up your offensive security skills
📰 Newsletter Archive
Explore all previous newsletter editions with weekly offensive security insights
Upgradeable Proxies: When the Upgrade Is the Attack
Delegatecall storage takeover, slot-0 storage collisions, uninitialized implementations, UUPS selfdestruct bricking (Parity/Wormhole), and initializer front-running
Supply Chain Attacks: Owning the Install Step
Dependency confusion, typosquatting on npm and PyPI, install-script code execution, maintainer account takeover, and the Shai-Hulud self-replicating npm worm
Breaking the Browser: WASM and WebGPU Exploitation
JIT type confusion in V8, WebAssembly RWX shellcode primitives, heap grooming with typed arrays, WebGPU/Dawn GPU-process bugs, and the multi-process sandbox escape chain
Cross-Chain Bridges: Minting Money From Nothing
Lock-and-mint trust models, validator key theft (Ronin), signature verification bypass (Wormhole), zero-root init bugs (Nomad), and Merkle proof forgery (BNB Token Hub)
Reentrancy: The Bug That Forked Ethereum
Classic single-function reentrancy, cross-function bypass of nonReentrant guards, read-only reentrancy via view oracles, ERC-777 token hooks, Vyper compiler bug, and Slither detection
Flash Loans: Borrowing Billions to Break DeFi
Flash loan anatomy via Aave V3, AMM spot price oracle manipulation, governance hijacking with borrowed tokens, MEV sandwich attacks via Flashbots, and the Euler Finance $197M exploit
Offensive eBPF: The Kernel as Your Backdoor
eBPF rootkit mechanics, PAM credential harvesting via uprobes, process and connection hiding via getdents64 hooks, XDP magic-packet backdoor, and nation-state deployments
SAML SSO Exploitation: Breaking the Trust Chain
XML signature wrapping variants, void canonicalization bypass, NameID comment injection, SAML attribute injection, and token replay against enterprise SSO
SyncJacking: On-Prem AD to Cloud Admin
Entra Connect hard-match hijacking, MSOL credential extraction, PTA agent backdoor, sync API abuse, and attack path mapping with AzureHound
Device Code Phishing: Stealing Tokens via Real Login
RFC 8628 device flow abuse, QR code social engineering, Storm-2372 token theft, TokenTacticsV2 commands, and Entra ID Conditional Access blocking
SCIM Exploitation: Hacking the Provisioning Layer
SCIM recon via ServiceProviderConfig, externalId collision for admin takeover, email hijacking via PATCH, unauthenticated endpoints, and group membership escalation
MCP Security: Poisoning the Tools Your AI Trusts
Tool poisoning via description fields, rug pull attacks, cross-server shadowing, RCE in MCP client tooling, and DVMCP practice lab
Prompt Injection: Hacking LLMs in 2026
Direct and indirect prompt injection, agent hijacking via tool abuse, system prompt leakage, RAG poisoning, and automated testing with garak
AWS Privilege Escalation: From Low-Priv Key to Admin
IAM policy attachment abuse, PassRole via Lambda for indirect escalation, EC2 instance profile exploitation, and PMapper for automatic path discovery
WebSocket Security: Hijacking, Injection, and Tunneling
Cross-site WebSocket hijacking, message-level XSS and SQLi, WebSocket smuggling for firewall bypass, and the toolset for interactive testing
GitHub Actions: Pipelines as Attack Surface
pull_request_target pwn requests, script injection via expressions, secrets exfiltration, poisoned pipeline execution, self-hosted runner persistence, and Gato-X
XSS: Reflected, Stored, DOM, and Blind
DOM source/sink model, stored XSS in rich-text editors, blind XSS against admin panels, framework pitfalls in React and Angular, and dalfox for scanning
DNS as a Weapon: Poisoning, Tunneling, and Rebinding
Kaminsky cache poisoning mechanics, SAD DNS side-channel attack, C2 over DNS with dnscat2, exfiltration techniques, and DNS rebinding to bypass Same-Origin Policy
OAuth 2.0: Six Ways the Authorization Flow Breaks
Missing state CSRF, redirect_uri hijacking, open redirect code theft, implicit flow token leakage, PKCE bypass, and SSRF via OpenID dynamic client registration
NoSQL Injection: Breaking MongoDB From the Inside
Operator injection, authentication bypass with $ne and $regex, blind boolean extraction, time-based $where detection, CouchDB default access, and automation tools
Redis and Memcached: When Cache Becomes a Foothold
Unauthenticated access, file-write RCE, module loading, SSRF via Gopher, CVE-2022-0543 Lua sandbox escape, and Memcached data extraction
Race Conditions: When Timing Is Everything
TOCTOU mechanics, limit overrun attacks, multi-endpoint races, and the single-packet technique that makes all of this consistently exploitable
WiFi Hacking 101: Wrapping Up the Series (Part 4)
PEAP relay attacks, ESSID stripping for WIDS bypass, and a complete wireless assessment checklist for enterprise engagements
WiFi Hacking 101: Exploiting Enterprise Networks (Part 3)
Breaking into 802.1X enterprise WiFi through credential capture, legacy method exploitation, and Pass-the-Hash attacks
WiFi Hacking 101: WPA/WPA2 Cracking, PMKID, and WPS (Part 2)
From 4-way handshake capture to offline cracking: WPA/WPA2 attacks, PMKID exploitation, WPS vulnerabilities, and what WPA3 actually protects against
Infrastructure Reconnaissance: Your First Steps in Network Pentesting
From nmap and nuclei to full infrastructure enumeration: a practical guide to discovering attack surface in bug bounty and pentesting
WiFi Hacking 101: Breaking Into Wireless Networks (Part 1)
A practical introduction to WiFi security testing covering the fundamentals, essential hardware, monitor mode, packet injection, and initial attack techniques
Deserialization Attacks: When Objects Become Weapons
From Java gadget chains to Python pickle exploits: a practical guide to exploiting insecure deserialization for remote code execution
Kubernetes for Pentesters: Breaking Orchestrated Infrastructure from Zero
From your first pod compromise to full cluster takeover: a practical introduction to Kubernetes security testing
Server-Side Template Injection (SSTI): Breaking Out of Templates
How attackers exploit template engines to achieve remote code execution by injecting malicious payloads into server-side templates
gRPC Security: Breaking the High-Performance RPC Protocol
A practical guide to gRPC security testing covering service enumeration, metadata exploitation, authentication bypass, and protobuf manipulation
LDAP Injection: Breaking Active Directory Authentication & Enumeration
A deep dive into LDAP injection exploitation, blind LDAP attacks, advanced AD enumeration via LDAP queries, and pass-back attacks against LDAP servers
iOS Security Testing: From IPA Analysis to Runtime Manipulation
A practical guide to iOS pentesting covering IPA decompilation, Frida hooking, certificate pinning bypass, and jailbreak detection circumvention
AWS for Pentesters: Your First Steps into Cloud Hacking
A beginner-friendly introduction to AWS security testing, from S3 buckets and metadata services to your first cloud foothold
Rust Security Code Review: When Memory Safety Isn't Enough
How to find vulnerabilities in Rust codebases despite the borrow checker, from unsafe blocks to logic bugs the compiler can't catch
HTTP Request Smuggling: The Art of Confusing Web Servers
How attackers exploit parsing discrepancies between frontend and backend servers to bypass security controls, poison caches, and hijack sessions
File Upload Vulnerabilities: From Filter Bypass to Full System Compromise
How attackers turn innocent file uploads into webshells, arbitrary code execution, and complete server takeovers
Prototype Pollution: Hacking JavaScript From the Inside
How modifying Object.prototype can lead to RCE, XSS, and complete application compromise
Docker Escape: Breaking Out of Containers
From misconfigured containers to full host compromise: a practical guide to container breakout techniques
XXE Injection: When XML Parsers Become Your Worst Enemy
From basic file disclosure to blind out-of-band exfiltration: a practical guide to finding and exploiting XXE vulnerabilities
NTLM Relay: Why Authentication in AD is Still Broken
How to force machines to authenticate to you, relay their credentials, and take over domains
CSP for Pentesters: Understanding the Fundamentals
Understanding the basics and spotting weak configurations
Hardware Security Modules: The Fortress Guarding Blockchain's Crown Jewels
How exchanges and institutions actually protect billions in crypto assets
Predictable Contracts: Understanding CREATE and CREATE2 in Ethereum
How deterministic addresses unlock powerful features and subtle attack vectors auditors should never overlook.
The Day an Email Broke Single Sign-On
Exploiting weak email validation in OAuth2 SSO
Taming the Beast: Practical Code Review with Security Tools
From endless lines of code to streamlined reviews with TruffleHog, CodeQL, and Trivy.
Bypassing Cloud Firewalls: Size Does Matter
Bypassing Akamai, CloudFront & Cloudflare with oversized requests.
ERC-20s in the Wild: Why Vanilla Assumptions Breaks
When ERC-20s Don’t Play Nice
Breaking Mobile-to-Device Logic: When BLE Access Falls Apart
Mobile apps that unlock doors might seem secure — until you replay a BLE packet, go offline, or bypass the logic entirely.
Reversing Android Apps: Bypassing Detection Like a Pro
Techniques to bypass root, Frida, and SSL protections in modern Android apps
When Web3 Withdrawals Meet Web2 Logic
How classic backend bugs like race conditions and IDORs still break Web3 withdrawal flows today
Cracking the iOS Keychain: What It Protects, Where It Fails
iOS Keychain 101: What It Is and How to Hack It
Android Keystore: Fort Knox or Glass Box?
Breaking and Defending Android’s Key Vault
Active Directory Enumeration: Mapping the Kingdom Before the Siege
Usernames, sessions and hidden privilege paths: uncovering the domain’s true structure
Biometric Authentication: Pretty Face, Weak Shield?
How biometric checks fool developers and how you can fool them back.
The Anatomy of a JWT Hack
JWTs: Small Tokens, Big Mistakes
🐙 Hacking GitHub – A Beginner’s Guide to Finding the (Not So) Hidden Stuff
Learn how exposed .git folders, sloppy commits, and forgotten tokens can turn a dev's mistake into your recon goldmine.
Inside the Request: From Basic SSRF to Internal Takeover
A practical guide to finding and exploiting SSRF vulnerabilities in modern applications.
Breaking Flutter: A Pentester’s Guide to Dart, Snapshots, and TLS Bypasses
Real-world techniques and tools for reversing Flutter apps, bypassing TLS pinning, and understanding how Dart code gets shipped in production.
Kerberos Tactics Every Pentester Should Know
A hands-on guide to the most effective Kerberos attacks in Active Directory environments
First Issue – Let’s Go
First Newsletter!
Frequently Asked Questions
Everything you need to know about Kayssel's newsletter
When is the newsletter published?
The newsletter is published every Sunday. You'll receive fresh offensive security content to start your week with updated knowledge.
What type of content does it include?
Each edition varies—it might cover hacking techniques I've been exploring, useful tips I've discovered, interesting tools, or insights that could be valuable for offensive security practitioners. Every newsletter brings something different based on what I'm learning and testing.
Is it free?
Yes, Kayssel's newsletter is 100% free. Just subscribe with your email and you'll start receiving quality content every Sunday.
Can I unsubscribe anytime?
Absolutely. Every email includes an unsubscribe link. You can opt out at any time with no hassle.
Who is this newsletter for?
For pentesters, bug bounty hunters, OSCP students, and anyone interested in offensive security who wants to stay updated with practical and actionable techniques.