Command-injection

Sep 28, 2022 · 12 min read

HackTheBox - Secret

Secret starts with analyzing web source to recover a secret token from older commit. The secret is …

Oct 18, 2021 · 12 min read

Dynstr imitates a company that offers a Dynamic DNS service. The provided API for this service is …

Oct 09, 2021 · 11 min read

Another late CTF writeups for H@cktivitycon 2021 web category.

Oct 04, 2021 · 9 min read

This is my late CTF writeups for H@cktivitycon 2021 miscellaneous category.

Aug 06, 2021 · 9 min read

Code execution with path traversal

Jul 10, 2021 · 10 min read

Supplying a malicious update definition to Electron-updater

Jun 26, 2021 · 10 min read

Getting password from automatic login script of ChromeOS

May 30, 2021 · 8 min read

DC-6 starts off by enumerating usernames from a WordPress website and use a brute-force attack …

May 15, 2021 · 9 min read

Turns SSRF to remote code execution and escape from a Docker container

May 08, 2021 · 8 min read

Seven times seven is equal to SSTI