Research & Publications

A Flask jukebox with hardcoded creds, unsafe YAML deserialization, and a root password leaked via the process list — three chained weaknesses to full compromise.

OSINT challenge using a leaked email to find a hidden Gravatar profile with a Base64-encoded flag — no exploitation, pure reconnaissance and enumeration.

Four-stage Linux box: NoSQL injection to bypass login, EJS SSTI for RCE, Node.js inspector abuse to pivot users, then disk group privilege escalation to root.

Race condition exploit on a Node.js staking reward endpoint — concurrent POST requests bypass the once-per-day claim check to multiply wallet balance beyond the whale threshold.

A single overprivileged SAS token in a static website’s JavaScript led to a full Key Vault compromise.

Zip Slip vulnerability in a hotel portal allows path traversal during ZIP extraction, leading to Remote Code Execution via automation hooks.

A hotel ping tool with command injection leads to SSH persistence, internal API credential leaks via Watchtower, FreePBX voicemail bearer token theft, and root RCE through an unsanitised automation export endpoint.

Analysis of a stealthy persistence backdoor hidden within Windows Group Policy registry strings. Covered Base64 extraction, raw DEFLATE stream parsing, and UTF-16LE string analysis.

A chess web app blocks the winning move using client-side JavaScript. By intercepting browser fetch calls and communicating with the API directly, the UI restriction is bypassed entirely and the flag extracted.

Same puzzle, harder gate. The server withholds the flag behind a session property check. After ruling out mass assignment and prototype pollution, a query string parameter injected into the move endpoint unlocks the reward.

An exploration of HTTP cookie header fields—how they work and best practices for secure session implementation.

A guide on intercepting and analyzing mobile app network requests using tools like Burp Suite.

A walkthrough of using Android Debug Bridge shell commands to access and control Android devices for debugging and development.