#pentestguy

Introduction: Apache Tomcat servers running vulnerable versions are currently exposed to a critical unauthenticated remote code execution (RCE) vulnerability – CVE-2025-24813. This flaw is caused by the PUT method being enabled by default, which allows an attacker to upload arbitrary files to the server. If exploited properly, this can lead to remote code execution.Here’s a quick look at the…

Introduction: When a Bug Finds You I wasn’t trying to be a hacker that day. I wasn’t running Burp Suite, intercepting requests, or testing for vulnerabilities. I was just a regular user, casually adding money to my wallet, when I noticed something strange: there was no OTP verification in online payments. You know that mandatory OTP verification every time you make an online transaction? That…

IntroductionWordPress is the most popular CMS, powering over 40% of websites. This widespread use makes it a prime target for hackers—and an excellent opportunity for ethical hackers and bug bounty hunters. Companies and website owners rely on security researchers to find and report vulnerabilities before malicious attackers exploit them. If you’re new to bug hunting and want to explore…

Introduction SMB (Server Message Block) is a widely used file-sharing protocol in Windows and Linux environments. While it enables seamless file and printer sharing, misconfigured SMB services can expose sensitive data, leading to serious security risks. That’s why SMB enumeration is a critical step in penetration testing, allowing ethical hackers to gather valuable system, user, and…

Hey everyone, Welcome to pentestguy, In this article, we are going to focus on the subdomain enumeration in detail, but it will be in an automatic way where we are combining different tools and trying to gather subdomains as much as possible. Why is Subdomain Enumeration required? The answer to this question is simple, an organization may have different products/services for internal or…

Hi everyone, welcome to pentestguy. In this post, we are going to discuss the ZAP Automation Framework in CI/CD, specifically how to implement the ZAP Automation Framework in your CI/CD pipeline to enhance security testing and streamline the integration process. ZAP Automation Framework? ZAP Automation Framework is an extension of the ZAP tool. It enhances ZAP’s capabilities by providing…

Hi everyone, Welcome to pentestguy. In this post, we are going to focus on how to set up and run mobsf automation in the ci/cd pipeline. We are using the Azure platform to run the mobsf automation and there creating a simple pipeline. What is MobSF-Automation? In the development process of any mobile application, there is a continuous process, where every time new code gets deployed and…