TryHackMe 'CyberHeroes' Box Exposes Credentials via Client-Side Login Logic

·9 views

A TryHackMe challenge called CyberHeroes, rated easy, demonstrates how authentication placed in browser-side JavaScript offers no real protection. A scan found SSH and an Apache 2.4.48 web server, and directory enumeration surfaced a login page. Viewing the page source revealed a JavaScript function that hardcoded the username and a reversed password, making the credentials trivially recoverable. The write-up stresses that authentication must be validated on the server, since anything delivered to the browser can be read and manipulated by an attacker.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Researchers Find Infostealer's AI Fallback Refusal Detector Misses Half of Refusals

Cisco Talos published analysis on October 31 of VOLTA, a self-deleting Windows infostealer that uses a chain of three AI models to build target assessments of victims. The malware checks model replies for two fixed refusal phrases and moves to the next model when it finds one, a design Talos interprets as anticipating guardrails. A test of that exact detector against 24 hand-written replies found it caught only six of twelve genuine refusals and wrongly flagged four compliant replies. The author attributes the misses to refusals worded differently from the quoted phrases and the false positives to harmless uses of the same wording.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CI check flags pull requests that add retired OpenAI or Anthropic models

A retired AI model rarely breaks tests, since those tests typically mock the LLM, and the failure instead surfaces in production after the shutdown date. The article proposes checking model identifiers at pull request time using a GitHub Actions workflow that requires no account or API key. Retired models cause the check to fail with a PR comment naming the file, line, and a suggested replacement, while models retiring within 90 days pass with a warning. The action can be configured to block on soon-to-retire models, scope checks to subfolders in monorepos, and expose outputs for custom workflow logic. The retirement data draws on dates published by providers including OpenAI, Anthropic, Google, Mistral, and AWS Bedrock, among others.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a React Mobile Hook Breaks SSR and How to Build a Hydration-Safe Version

A useIsMobile hook returns false on the server because no screen width exists during server rendering, so the hydration pass must repeat that guess. Reading window during render can cause hydration errors when the text differs, and in other cases it leaves the server's value on screen until hydration completes. The article recommends using CSS breakpoints for visible layout changes, since they apply at first paint. For behavior after user interaction, it proposes a hook built on useSyncExternalStore with a server snapshot, so hydration matches and later mounts read the real value immediately.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Home lab retires old setup, switches to new accounts and tools after October

A developer documents the retirement of several components from their two-machine home lab during October 2026, including a Raspberry Pi 5 account and an OpenVINO runtime. The Pi's user account was retired on October 3 after its contents were copied to a new account and verified by hash before deletion. OpenVINO underperformed ONNX Runtime on the Intel mini PC's CPU across several models, though it performed better on the integrated GPU in FP16. The author also reports an automation task failing on October 9 due to permission issues. The write-up presents each retirement as a documented record with its technical cause and lessons learned.

0 comments Read more at DEV Community