Technology

Hacked & Secured: Pentest Exploits & Mitigations

by Amin Malekpour

Share this ranking Is this your show? Claim it

Listen on Apple Podcasts Pocket Casts RSS feed

Chart positions today · United States

Not on the United States charts we track today.

If you like Hacked & Secured: Pentest Exploits &…, try…

7 Minute Security

Latest episodes

Ep. 13 – nOAuth Account Misbinding & Assumed-Breach to Domain Admin (Season Finale)

September 29, 2025 · 15 min

One misbound identity. One exposed internal path. Two routes to total compromise. In this season finale of Hacked & Secured: Pentest Exploits & Mitigations, we break down two real-world findings that show how small trust assumptions can…
Ep. 12 – Timing Attacks & Mobile OAuth Hijack: When Microseconds and Misflows Betray You

August 28, 2025 · 14 min

A few microseconds. One silent browser session. That’s all it took for attackers to break into systems without tripping a single alert. In this episode of Hacked & Secured: Pentest Exploits & Mitigations, we explore two subtle but…
Ep. 11 – Account Takeover, Token Misuse, and Deserialization RCE: When Trust Goes Wrong

July 24, 2025 · 17 min

One flawed password reset. One shared session token. One dangerous object. In Episode 11 of Hacked & Secured: Pentest Exploits & Mitigations, we break down three real-world vulnerabilities where trust between systems and users broke…
Ep. 10 – Cookie XSS & Image Upload RCE: One Cookie, One File, Full Control

June 26, 2025 · 20 min

One cookie set on a subdomain triggered XSS and stole session tokens. One fake image upload gave the attacker a reverse shell. This episode breaks down two powerful exploits—a cookie-based XSS that bypassed frontend protections, and an RCE…
Ep. 9 – Directory Traversal & LFI: From File Leaks to Full Server Crash

May 29, 2025 · 25 min

One markdown link copied server files. One poisoned log triggered remote code execution. One LFI crashed the entire server. In this episode, we unpack three real-world exploits—directory traversal and local file inclusion flaws that went…

Show 7 more episodesShow fewer episodes

Ep. 8 – OTP Flaw & Remote Code Execution: When Small Flaws Go Critical

April 24, 2025 · 16 min

A broken logout flow let attackers hijack accounts using just a user ID. A self-XSS and an IDOR exposed stored data. And a forgotten internal tool—running outdated software—ended in full Remote Code Execution. This episode is all about…
Ep. 7 – IDOR & SSTI: From File Theft to Server-Side Secrets

April 10, 2025 · 20 min

A predictable ID exposed private documents. A crafted name leaked backend files. In this episode, we break down two high-impact flaws—an IDOR that let attackers clone confidential attachments, and an SSTI hidden in an email template that…
Ep. 6 – 403 Bypass & Request Smuggling: Tiny Tricks, Total Takeover

March 27, 2025 · 17 min

A single uppercase letter unlocked an admin panel. One malformed request hijacked user sessions. In this episode, we break down two real-world exploits—a 403 bypass and a request smuggling attack—that turned small oversights into full…
Ep. 5 – Stored XSS & SQL Injection: Small Flaws, Big Breaches

March 13, 2025 · 16 min

A simple filename triggered stored XSS, hijacking accounts and stealing API keys. A SQL injection bypassed a web firewall, dumping an entire database in one request. Both attacks exploited basic security flaws—flaws that should have been…
Ep. 4 – Exposed Secrets & Silent Takeovers: How Misconfigurations Open the Door to Attackers

February 27, 2025 · 21 min

Exposed secrets, overlooked permissions, and credentials hiding in plain sight—each one leading to a critical breach. In this episode, we break down three real-world pentest findings where a forgotten file, a misconfigured setting, and a…
Ep. 3 – One Request, One URL, One Bluetooth Hack: Three Takeovers That Shouldn’t Have Happened

February 13, 2025 · 22 min

How can attackers take over accounts, networks, and devices—without credentials? In this episode, we break down three real-world security flaws that prove authentication alone isn’t enough: Account Takeover – A single request bypassed…
Ep. 2 – Chaining IDORs, CSRF Account Takeovers & Token Manipulation for Privilege Escalation

January 30, 2025 · 19 min

What if you could take over an account—not by cracking a password, but by chaining two overlooked vulnerabilities? What if a single CSRF exploit let attackers reset security questions and hijack accounts? And what if manipulating an…

Full episode archive on Apple Podcasts →

About the show

If you know how attacks work, you’ll know exactly where to look—whether you’re breaking in as an ethical hacker or defending as a blue teamer. Hacked & Secured: Pentest Exploits & Mitigations breaks down real-world pentest findings, exposing how vulnerabilities were discovered, exploited, and mitigated. Each episode dives into practical security lessons, covering attack chains and creative exploitation techniques used by ethical hackers. Whether you're a pentester, security engineer, developer, or blue teamer, you'll gain actionable insights to apply in your work. 🎧 New episodes every month. 🌍 Follow & Connect → LinkedIn, YouTube, Twitter, Instagram, Website Link 📩 Submit Your Pentest Findings → https://forms.gle/7pPwjdaWnGYpQcA6A 📧 Feedback? Email Us → podcast@quailu.com.au