// LEARNER HUB
Field Notes & Write-Ups
Practical guides on web exploitation, bug bounty methodology, and offensive security —
written from real hunting experience, not recycled theory. New articles added regularly.
// GUIDE
How to Learn Cybersecurity in Africa (Without Paying Western Course Prices)
Why the real barrier to breaking into security work from Africa isn't talent, and how hands-on labs close the access gap that expensive Western bootcamps assume you can afford.
→
// ARTICLE
Understanding XSS: Reflected, Stored, and DOM-Based
The three types of Cross-Site Scripting explained, why simple input escaping fails across different contexts, and what a convincing bug bounty XSS report actually needs.
→
// ARTICLE
IDOR Vulnerabilities Explained: The Bug Everyone Finds and Nobody Fixes
What Insecure Direct Object Reference actually is, where it hides in real applications beyond obvious URL parameters, and the two-account testing habit that finds it consistently.
→
// GUIDE
Building a Recon Workflow: From Subdomain Enumeration to First Findings
How experienced hunters map an attack surface before testing a single vulnerability — and why the highest-value bugs live on the parts of a target fewer people bother to find.
→
// ARTICLE
JWT Algorithm Confusion: Why Weak Token Verification Still Works in 2026
How 'alg: none' and RS256-to-HS256 algorithm confusion attacks work, why they keep surfacing in production apps, and what to check when a target uses JWTs.
→
// FIELD NOTES
What Bug Bounty Hunting Actually Looks Like Day to Day
A realistic look at target selection, recon, testing hypotheses, report writing, and handling the duplicates and rejections that happen to every hunter.
→