IT-Security Insights
Articles for businesses and development teams, plus technical analysis covering penetration testing, secure development, vulnerability research and bug bounty.
These articles combine specific vulnerabilities, attack chains and practical experience with the question of what they mean for applications, development processes and security decisions.
A look behind the scenes of my IT infrastructure: why my work environment, pentest lab, management, storage, and local AI are separate—and why VLANs alone do not make a security architecture.
A failed proof of concept does not yet demonstrate effective remediation. The root cause, related attack paths, deployment, and retesting are what matter.
ReadOpenAI and Anthropic demonstrate how AI agents can compromise real systems. Why this is not a Skynet moment—and why proven IT security measures matter more than ever.
ReadHow companies define the scope of a web and API penetration test: systems, roles, business risks, testing methods, and clear rules of engagement.
ReadSometimes a single parameter such as redirect_to is enough to turn a harmless redirect into a genuine security risk.
ReadWhy Cross-Site Scripting remains relevant despite modern frameworks and which assumptions frequently fail in practice.
ReadPath Traversal while extracting plugins in JetBrains TeamCity before 2025.07 allowed Arbitrary File Write on Windows.
ReadStored Cross-Site Scripting in the backup settings of JetBrains TeamCity before 2024.07.3.
ReadPath Traversal in JetBrains TeamCity before 2024.07.3 allowed a backup file to be written to an arbitrary path.
ReadPath Traversal in JetBrains TeamCity before 2024.07.3 allowed readable files to be disclosed through server backups.
ReadA backup file in JetBrains TeamCity before 2024.12 exposed credentials and session information.
ReadA technical lab analysis covering a format string vulnerability, a controlled ROP chain, and exploit development.
ReadAI can analyze source code quickly, yet many automatically generated bug bounty reports lack reproducible impact. Which quality criteria are missing, and where can AI provide useful support?
ReadDuplicates can be disappointing at first, but often help build reputation, earn private invitations, and support long-term success in bug bounty hunting.
ReadA practical introduction to structured reconnaissance, safe testing environments, suitable tools, and reproducible example workflows.
ReadMany beginners in bug bounty hunting ask the same question: Where do I start?
ReadBug bounty hunting may sound like quick money, but in reality it is a marathon, not a sprint.
Read