We’ve published new research exposing critical vulnerabilities in Anthropic’s Model Context Protocol (MCP). Our findings reveal Full-Schema Poisoning attacks that inject malicious logic into any schema field and Advanced Tool Poisoning techniques that trick LLMs into leaking secrets like SSH keys. These stealthy attacks only trigger in production. Full details and PoC are in the blog.
While experimenting with the idea of converting a normal USB (e.g., SanDisk) into a BadUSB or Rubber Ducky device, I explored its technical limitations and potential uses for cybersecurity learning.
This write-up documents what worked, what didn’t, and why reprogrammable microcontrollers (like those in Digispark or Rubber Ducky) are essential for true HID emulation.
I also shared a hands-on PowerShell experiment for extracting Wi-Fi credentials as a basic USB-based manual attack vector.
Hey everyone,
I'm excited to share **XAttacker V50 Pro**, a professional, high-powered exploitation tool designed for scanning and automatically exploiting vulnerabilities in web applications. By simply providing a target URL, XAttacker analyzes the website’s architecture—especially if it's built on a Content Management System (CMS)—and identifies weaknesses based on the detected platform. Once vulnerabilities are found, XAttacker automatically generates a working exploit tailored for the targe
