API Attack Skill Assessment
Escalating from customer to supplier via role enumeration, security-question brute-force, and JWT re-authentication to achieve RCE.
$ whoami
db1M
$ cat focus.txt
Web Pentest / Vulnerability Research / Secure Code Review / AI Security
$ ./status --live
exploring the unknown
$ ls ./write-ups
Latest
Filter by tag
GraphQL Skill Assessment
Exploiting GraphQL introspection to leak API keys, then chaining SQL injection through customer queries to dump the flag.
File Inclusion Skill Assessment
Chaining LFI path traversal, source code disclosure, and double URL encoding to gain RCE through an uploaded PHP shell.
CAT CTF 26 — Entry Level (Author Write-Ups)
Write-ups for 3 web challenges I created at CAT CTF 26: Admin Jokes, Forest Secrets, and Paper Tail.
No Notes CRLF Challenge | Hackena Ramadan CTF
Exploiting HTTP response splitting to steal cookies from an isolated bot using timing side-channel attacks.
Czechoslovakia XSS Challenge | Hackena Ramadan CTF
Exploiting XSS in a filtered input parameter using the /a// bypass technique to steal the admin bot's FLAG cookie through webhook exfiltration.
File Upload Skill Assessment
Chaining unrestricted file upload, path traversal, and double URL decoding to gain remote code execution.
SQL Injection Skill Assessment
Chaining SQL injection bypass, UNION-based enumeration, and INTO OUTFILE to gain RCE on a web application.
Web Fuzzing Skill Assessment
Directory fuzzing with ffuf to discover hidden files, admin panels, and restricted endpoints leading to the flag.
Information Gathering Skill Assessment
Reconnaissance methodology covering DNS enumeration, WHOIS lookups, subdomain discovery, and web footprinting to map an attack surface.
BCACTF 2025 Write-Up
Solving 10 challenges across Misc, Binary Exploitation, Crypto, and Web at BCACTF 2025.
11 write-ups shown
No matching write-ups.
Try a different filter.