Server hardening, API security, CVEs, threat defence and legal bug bounty practice for sysadmins
A dated backup copy of wp-config.php in the web root was served over HTTPS. How I checked using only the status code, moved it, read the logs and what to rotate if secrets may have leaked.
I deleted the UFW rule for a port and it still answered from the internet. Docker publishes ports before UFW sees the packets. How to check from outside and how to bind the port to localhost.
Random-named .jsp files in your MagicInfo server folder are a red flag. Here is how to check if your Samsung MagicInfo 9 server was hit by CVE-2024-7399 or CVE-2025-4632, what to preserve, how to clean up, and how to patch.
A defensive Linux privilege-escalation audit with real output: sudo rules, SUID and SGID files, capabilities, root-equivalent groups, writable cron paths and patch level.
Remote Desktop closes after you enter the password and drops you back at the Remote Desktop Connection window, with no error? On Windows Server after the September 2026 update KB5122882, the fix is the out-of-band KB5129237. Plus the brute-force attempts we found while fixing it, and how we restricted RDP to client IPs with Windows Firewall.
What AI really changes for attackers, the risks in the AI tools you deploy, and a practical defence plan covering MFA, DMARC, policies and agents.
Most breaches don’t start with a novel exploit. They start with a default password, an exposed admin panel, or a stray .env file. The defensive checklist I actually run.
A CVSS score alone isn’t a patch decision. Here’s how to actually read an advisory, check whether it applies to what you run, and decide how urgently to act.
PortSwigger Web Security Academy, OWASP Juice Shop, DVWA and a properly isolated VM setup — everything you need to practice exploitation legally before your first real program.
Your infrastructure background is a real advantage in bug bounty hunting. Here’s what to learn first, how scope and authorization actually work, and where to practice legally.