What Breaking Things in Labs Taught Me That Certifications Never Did
Field notes from building this site hands-on labs: the failure intuition certifications cannot teach, and how to start with zero budget.
Read More →HMMNM is an independent cybersecurity education and research practice led by Prabhu Kalyan Samal. We publish hands-on ethical hacking tutorials, detection engineering guides, weekly threat intelligence, and deep dives into the breaches that shaped the industry — so students, developers, and defenders learn security by studying how it really breaks.
Featured Posts
Security
Exploitation techniques, vulnerabilities, and defense strategies
A practical guide to software supply chain security covering dependency risks, secrets exposure, CI/CD trust failures, artifact integrity verification, SBOM...
Read More →
A decade analysis of ransomware evolution from 2016 to 2026, covering RaaS operations, double extortion, initial access brokers, living off...
Read More →
In-depth guide to HTTP request smuggling attacks. Learn how to exploit discrepancies between frontend proxies and backend servers in both...
Read More →
A deep dive into Server-Side Template Injection (SSTI) — how template engines turn attacker input into RCE, with discovery, exploitation...
Read More →
A practical guide to agentic AI security covering goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, multi-agent trust...
Read More →
10 essential tips for aspiring ethical hackers. Build your cybersecurity career with practical advice on certifications, tool proficiency, lab environments,...
Read More →
How identity became the new perimeter in modern cybersecurity. Explore MFA bypass techniques, OAuth consent phishing, device code attacks, token...
Read More →
Learn error-based exploitation techniques used by pentesters to extract sensitive data from vulnerable applications. Covers SQL injection, SSTI, and other...
Read More →
Complete cross-site scripting (XSS) tutorial covering stored, reflected, and DOM-based XSS with practical exploitation examples and prevention strategies including CSP.
Read More →
A practical analysis of API security authorization flaws behind modern breaches. Covers BOLA, BFLA, IDOR, mass assignment, shadow APIs, and...
Read More →
The OWASP Top 10 for Agentic Applications defines the most critical security risks for autonomous AI agents in 2026. From...
Read More →
Red teaming LLM applications requires fundamentally different techniques than traditional penetration testing. This playbook covers the complete methodology: reconnaissance, attack...
Read More →
Learn step by step
Twenty guided paths — web pentesting, bug bounty, incident response, threat modeling, cloud, and more — with progress tracking, no account needed.
Explore Learning Paths →Need it done for you?
Hmmnm offers professional security services — from penetration testing, red teams, AD, containers, wireless, AI security and virtual CISO — built on the research you read here.
View Security Services →Security Products
Customizable compliance documents & checklists plus in-house security scanners — built from the research you read here.
Browse Products →Technology
MCP, APIs, cloud, and emerging tech deep dives
How Terraform state works, why it stores secrets in plaintext, and the remote-backend, locking and drift practices that make it...
Read More →
How QUIC rebuilt web transport on UDP: per-stream delivery, 1-RTT handshakes with TLS 1.3 inside, connection migration — and the...
Read More →
How eBPF runs verified, JIT-compiled programs safely in the Linux kernel — and why networking and security tools bet their...
Read More →
Beyond Security
New seriesField notes from outside the terminal — health, life and personal journeys.
CYBERSECURITY UPDATES
Never miss a security briefing.
New threat analyses, tool guides and hardening playbooks — delivered straight to your inbox, the moment they go live.
DOUBLE OPT-IN • NO SPAM • UNSUBSCRIBE ANYTIME
HMMNM.COMEST. 2025