❄️ Yeti’s back, sharpened claws ready, and today we’re hijacking trust itself — one forged request at a time. We’re taking on a classic yet devastating vulnerability from the PortSwigger Web Security Academy: 🔥 Cross-Site Request Forgery (CSRF) — with zero defenses. Let’s break the internet... respectfully. 🧊 What is
Heyo snowpackers — Yeti here, fresh off the slopes and armed with a fuzz cannon. Today, we’re smashing down snow-covered doors in the world of directory busting — one of the oldest recon tactics that still lands juicy bugs (and bounty bucks). Let’s melt some ice with FFUF and
Hey everyone — Yeti is back with another snowball of wisdom. Today we’re diving into one of the oldest (but still dangerously effective) attack methods in the web hacking playbook: brute forcing. And where better to practice this ancient art than inside the vulnerable jungle gym known as OWASP Juice
webapp
Hey everyone, it’s Yeti back again, and lately I’ve been sharpening my claws on some bug bounty practice — diving into one of the best playgrounds for web app security: OWASP Juice Shop! 🍹 This app is modern, full of real-world scenarios, and absolutely loaded with vulnerabilities just waiting
Projects
Hey everyone, 404Yeti here! Today I’m walking you through one of my biggest setups yet — building a custom Jenkins CI/CD environment using Docker, Go, and pipelines with agents. This guide covers: * 🧊 Setting up Jenkins with Docker * 🛠 Running freestyle builds * 🔁 Cloning Go projects and executing scripts * 🧪 Building a pipeline
Projects
Hey everyone — 404Yeti here, back from the Icebox ❄️ Today I want to share a project I built called RedFlag, a purposely vulnerable web app that’s small in size but massive in security training value. Whether you’re learning web hacking, prepping for CTFs, or brushing up on your Redis
Projects
Hey everyone, Yeti here 🐾 As part of my journey into deeper AppSec, I wanted to build something that combines everything I’ve been learning: APIs, real-time backend behavior, front-end vulns, and secure(ish) architecture — then rip it all wide open. So I built DVCA – Damn Vulnerable Chat App
webapp
Hey everyone, 404Yeti back in the Icebox! ❄️ Today is Day 3 of the Postman 30 Day Challenge, and we’re diving into something that may sound simple — but it’s a game-changer for productivity and security: Organizing and enriching your requests with folders, variables, and metadata. This is the
webapp
“Make your API testing life easier, one variable at a time.” – 404Yeti Hey snow crew, Yeti here! ❄️ Today’s mission in the Postman 30 Day Challenge is all about reducing chaos and leveling up your workflow using environments and variables. Let’s face it — if you're copy-pasting
webapp
Hey everyone, 404Yeti here! I’ve officially kicked off the Postman 30 Day Challenge to level up my API testing skills — not just for development, but for security. Why? Because APIs are everywhere — and securing them is one of the most underrated but critical skills in modern pentesting. There’s
Projects
Hey snow crew! ❄️ 404Yeti here, and today we’re grinding some beans and processing some streams — Kafka streams, that is. Ever wonder what happens when you mix caffeine, microservices, and Go? You get a blazingly efficient, message-driven coffee ordering system, fueled by Flippers, Go routines, and far too much
Projects
Hey snow squad, Yeti here! 👋 Today I’m thawing out my very first backend project — a complete gRPC microservice built with Go, powered by curiosity, caffeine, and just a pinch of chaos. Let’s walk through why I built it, what I learned, and why it matters (especially if you