Red Team

October is Cybersecurity Awareness Month, and Citrix just handed attackers a gift. Three zero-days in NetScaler ADC and Gateway — exploited in the wild before patches existed, chained together for persistent access, and added to CISA’s Known Exploited Vulnerabilities catalog within days of disclosure. If your organization runs a customer-managed NetScaler appliance, this one isn’t theoretical. Here’s the full breakdown: what happened, how the attack chain worked, and what red teamers and defenders need to know right now. ...

File inclusion vulnerabilities are deceptively simple on the surface — you trick an application into loading a file it shouldn’t. But the exploitation paths they open up range from sensitive data disclosure all the way to full remote code execution. Log poisoning, PHP filter chains, session file injection, null byte tricks — this vulnerability class has more depth than most. If you’re doing web app pentesting or bug bounty hunting in 2026, you’ll encounter file inclusion regularly. PHP applications are the most common target, but the patterns appear in other languages too. This guide covers LFI and RFI from first principles through advanced exploitation. ...

Command injection is one of the most dangerous vulnerability classes in web security. Not because it’s subtle — it’s actually one of the most direct paths to full system compromise. You inject a shell command through a web input, the server executes it, and suddenly you’re running arbitrary code on someone’s infrastructure. OWASP has kept injection in its Top 10 for over a decade for good reason. When you find command injection, the game changes. It’s not “I can read a record I shouldn’t.” It’s “I own this server.” ...

Server-Side Request Forgery (SSRF) is one of the most dangerous and consistently exploited web vulnerabilities of the last five years. It made the OWASP Top 10 in 2021 and has been weaponized in some of the biggest breaches in cloud history — including the Capital One breach that exposed 100 million records. If you’re doing web application pentesting or bug bounty hunting in 2026 and you’re not hunting SSRF systematically, you’re leaving money and flags on the table. ...

Cross-site request forgery is one of those vulnerabilities that sounds simple until you actually try to exploit it in a modern application. In theory: trick a user’s browser into making an authenticated request to a target site. In practice: CSRF token validation, SameSite cookie policies, and Referer checks have made it significantly harder — but not impossible. In 2026, pure CSRF is less common on major platforms, but it still shows up regularly in internal tools, legacy enterprise apps, custom-built APIs, and any application that implements CSRF protection carelessly. And when CSRF tokens are present but misconfigured, the bypass is often trivially easy. ...

Cross-site scripting has been broken for as long as the web has existed. In 2026, it still shows up everywhere — modern SPAs, legacy enterprise apps, AI-generated frontends with no output encoding, CMS platforms with half-baked sanitization. XSS is the kind of vulnerability that’s “easy” to dismiss until you see a session token extracted from a banking app or a phishing payload delivered from a trusted domain. This guide covers everything: how XSS works, the three main categories, detection with Burp and manual techniques, exploitation for real impact, filter bypass when WAFs and sanitizers are in the way, and DOM-based XSS which most people still get wrong. ...

SQL injection has been on the OWASP Top 10 since the list started. In 2026, it still breaks real systems. Poorly sanitized inputs, legacy codebases, ORM misconfigurations — the attack surface hasn’t gone away. If anything, the rise of AI-generated code has introduced new classes of injection bugs. This guide covers everything: how SQLi works, how to detect it, how to exploit it across all major categories, how to weaponize SQLMap, and how to bypass WAFs when they’re in the way. ...

Web application pentesting is where most red teamers spend the majority of their billable hours. It’s also where a huge chunk of real-world breaches happen — not through exotic exploits, but through the same OWASP Top 10 vulnerabilities that have existed for decades. This guide covers the full methodology: reconnaissance, mapping the attack surface, exploiting common vulnerabilities, and reporting findings. Whether you’re doing your first web pentest or sharpening your methodology for bug bounty, this is the process. ...

OSINT is where red team engagements actually begin. Not when you fire up Metasploit. Not when you scan the first subnet. Before any of that — you do recon. You learn everything you can without touching the target. Done right, OSINT tells you where the doors are before you ever try to open one. This guide covers the full methodology: what to collect, which tools to use, how to stay invisible while doing it, and how to turn raw intelligence into an attack plan. ...

The Social Engineering Toolkit (SET) is one of the most important tools in a red teamer’s arsenal — and also one of the most misunderstood. Built specifically for social engineering attacks, it’s not just a script kiddie toy. Used properly, SET simulates the exact attack chains that real threat actors use to compromise organizations. This guide covers everything: installation, attack modules, credential harvesting, spear phishing campaigns, website cloning, and the OPSEC considerations that separate a successful engagement from a burned infrastructure. ...