SQL Injection & Remote Code Execution - Double P1

How I Hacked the Dutch Government - Exploiting an Innocent Image for Remote Code Execution

Full-Blown SSRF to Gain Access to Millions of Users Records and Multiple Internal Panels