Welcome to the KevinSec Blog.
This section contains practical notes, technical breakdowns, lessons learned, and field observations from offensive security work.
Reflected XSS happens when user-controlled input is returned in an immediate response without safe output handling.
A SQL error message is not the vulnerability itself. It is a clue that the application may be building queries unsafely.
SQL injection happens when untrusted input becomes part of a database query structure instead of remaining data.
SSRF happens when a web application can be tricked into making server-side requests to unintended locations.
Stored and reflected XSS share the same browser-side risk, but they differ in persistence, delivery, and business impact.
Use this checklist to review login, registration, password reset, session management, MFA, and account recovery flows.
Broken access control allows authenticated users to access data or actions they should not be allowed to access.
Learn how pentesters inspect HTTP methods, paths, parameters, headers, cookies, and request bodies to identify potential security risks.
Learn how Insecure Direct Object Reference works, why it happens, and how to test it safely in labs such as PortSwigger, DVWA, or OWASP Juice Shop.
Understand the OWASP Top 10 2025 categories, what they mean, and how beginners should use them in web security learning.