Ethical hacking & pentesting blog
Come for the PoCs and security research focused on new CVEs and stay for the ethical exploitation guides and how-tos our offensive security specialists create.
We brought AI Pentests to DEF CON. Here's what practitioners actually said
87.8% of practitioners say AI findings still need manual validation. We took AI Pentests to DEF CON to find out if that holds up in front of the people who'd actually use it. Here's what came back.
- Author(s)
- Published at
- Updated at
We brought AI Pentests to DEF CON. Here's what practitioners actually said
87.8% of practitioners say AI findings still need manual validation. We took AI Pentests to DEF CON to find out if that holds up in front of the people who'd actually use it. Here's what came back.
- Author(s)
- Published at
- Updated at
Get fresh security research
In your inbox. (No fluff. Actionable stuff only.)
wp2shell (weekend to shell edition)
WordPress runs roughly 40% of the internet, so when a routine weekend dig into its REST API turned up a pre-auth path to full database compromise, we didn't get much sleep. In this write-up, we chain a batch-endpoint route confusion bug (CVE-2026-63030) with a SQL injection in WP_Query (CVE-2026-60137) to go from anonymous request to admin account, no cracked hashes required. Read the full article to see how we faked oEmbed cache entries, built a nav_menu_item privilege chain out of seven UNION queries, and landed a webshell without ever logging in.
- Published at
- Updated at
When AI writes the code, who validates its security?
We surveyed 241 developers about how AI coding tools have changed their work. The pattern was consistent across roles: AI didn't introduce a new class of risk on its own. It accelerated an existing one. Code ships faster than anyone can validate it, and the gap shows up after deployment, not before.
- Author(s)
- Published at
- Updated at
Explore our vulnerability research
DotNetNuke: XSS to RCE (CVE-2026-40321)
DotNetNuke (DNN) might be a leading CMS in the Microsoft ecosystem, but a routine test on an older version accidentally led us straight to a brand-new 0-day. In this write-up, we escalate a simple Stored XSS vulnerability into a full Remote Code Execution (RCE) chain (CVE-2026-40321). Read the full article to see how we smuggled payloads inside SVG files, weaponized DNN's internal messaging to spear-phish admins, and seamlessly dropped an ASPX backdoor right into the server root
- Author(s)
- Published at
- Updated at
Throwing a spark into FuelCMS
FuelCMS v1.5.2 might be an older, largely unmaintained project, but its codebase is still highly combustible. In our latest research sprint, we uncovered seven new vulnerabilities lurking under the hood. Read the full article to see the raw HTTP requests, learn how we bypassed brute-force rate limits, and watch us turn simple template syntax into a full system compromise.
- Author(s)
- Published at
- Updated at
cPanel - The valid, the suspect, and the 3rd party (Part 1)
Ever wondered what you can still do with 25-year-old code in a modern hosting environment? PTT-2025-021 was quite the journey! Unpack this (potentially Remote) Code Execution vulnerability we discovered and disclosed, which lets you bypass restricted environments like cPanel's jailshell. In part 1 of 3, we break down how an unsafe Perl "open" function became our ticket to a executing arbitrary system commands - and how the exploit works.
- Author(s)
- Published at
- Updated at
Video updates
🎰 August 2026 on Pentest-Tools.com: 155 new detections, our DEF CON debut, and AI inside the product
See more videosPopular articles
- Milestones
Year in review: from routine to results in 2025
Security teams had to cover more assets, respond to more CVEs, and explain more findings to more people than ever. And not just explain them - defend them. In front of clients. In front of auditors. In front of leadership that wants to know what actually changed since the last in-depth test.
- Published at
- Updated at
- Security research
How we built an exploit for SessionReaper, CVE-2025-54236 in Magento 2 & Adobe Commerce
Here's how we weaponized SessionReaper (CVE-2025-54236) against Magento 2, chaining ServiceInputProcessor quirks and a session proxy setter to forge customer sessions and hijack accounts. Our lab-tested PoC exposes attack surface, a possible preauth RCE, and an automated exploit - a practical walkthrough for researchers who like coffee strong and bugs reliable.
- Published at
- Updated at
- Security research
Breaking down the 5 most common SQL injection attacks
In this ongoing battle, organizations and offensive security pros grapple with many questions: Why do these attacks persist? What are the most prevalent types of SQL injection attacks? And, most importantly, how do we prevent them effectively? You’ll get answers to these burning questions (and more!) in this practical guide.
- Author(s)
- Published at
- Updated at
Year in review: from routine to results in 2025
Security teams had to cover more assets, respond to more CVEs, and explain more findings to more people than ever. And not just explain them - defend them. In front of clients. In front of auditors. In front of leadership that wants to know what actually changed since the last in-depth test.
- Published at
- Updated at
A comprehensive deep dive into React2Shell (CVE-2025-55182)
React2Shell (CVE-2025-55182) is a CVSS 10.0, pre-auth remote code execution flaw in the React Server Components Flight protocol. This deep dive maps affected React and Next.js versions, explains the deterministic exploit chain, summarizes in-the-wild abuse, and lays out detection, mitigation, and validation steps you can apply in real environments.
- Author(s)
- Published at
- Updated at
How we built an exploit for SessionReaper, CVE-2025-54236 in Magento 2 & Adobe Commerce
Here's how we weaponized SessionReaper (CVE-2025-54236) against Magento 2, chaining ServiceInputProcessor quirks and a session proxy setter to forge customer sessions and hijack accounts. Our lab-tested PoC exposes attack surface, a possible preauth RCE, and an automated exploit - a practical walkthrough for researchers who like coffee strong and bugs reliable.
- Published at
- Updated at
How web cache poisoning works and how to exploit it
Elevate your next pentest by exploiting web cache poisoning. This deep dive uncovers the RFC nuances, common misconfigurations, and unkeyed request components that transform low-severity injections into critical, widespread compromises. Learn practical detection, exploitation (with PoCs!), and advanced mitigation techniques to weaponize your findings.
- Author(s)
- Published at
- Updated at
What the experts say: Machine learning in offensive security
In this third installment, we stop talking and start listening. We asked seasoned offensive security professionals how they actually use machine learning in the field. Their verdict? ML works, when it’s focused. From spotting phishing entry points to flagging suspicious authentication patterns, the value is real. But it’s not magic. Used blindly, it adds noise. Used wisely, it accelerates analysts.
- Author(s)
- Published at
- Updated at
