/ Recent content on Hugo -- gohugo.io Mon, 01 Sep 2025 00:00:00 +0000 /blog-posts/apex-hunting-101/ Mon, 01 Sep 2025 00:00:00 +0000 /blog-posts/apex-hunting-101/ Goal: turn a single target into a wide, defensible attack surface by discovering apex domains owned by the company, its acquisitions, and its sub-organizations—using only open sources. Great bugs often live just outside the obvious example.com. If you can map acquired brands and subsidiaries, you’ll uncover older tech stacks, forgotten portals, and regional sites that are still very much in scope for “wide-scope” programs. Below is the exact recon playbook I use. /blog-posts/hacking-chatbot-pii-data-leak/ Tue, 19 Aug 2025 00:00:00 +0000 /blog-posts/hacking-chatbot-pii-data-leak/ During recon on a large e-commerce target, I landed upon a domain with a pretty interesting chatbot functionality. It could manage orders, process cancellations, and hand you off to a live agent. Even better (or worse), when you were logged in, the bot “helpfully” pulled up your recent orders. Cool! This was all I needed to take a close look. To keep things realistic, I bought an item as a guest with an email I control — call it victim-me.