Offensive tradecraft, deep-dive vulnerability research, threat actor analysis, and modern cybersecurity methodology.
URL encoding (percent-encoding) turns unsafe characters into %XX. Here is %20 vs +, UTF-8, double encoding, and why validators must decode once first.
A hash is a fixed-length fingerprint of data. Here is how MD5 and SHA-256 differ, why fast hashes are wrong for passwords, and what HMAC adds.
A JWT is a signed bundle of JSON claims. Here is how to read one, why decoding is not verifying, and how to check for the classic JWT security flaws.
