Writeups & Research

A webhook testing feature that fetched user-supplied URLs with no validation allowed an attacker to proxy requests through the server — reaching internal services, cloud metadata endpoints, and sensitive infrastructure.

A custom CDN middleware implementation with a flawed caching strategy allowed any unauthenticated user to poison the cache and retrieve sensitive account data belonging to other users.

A login form built with raw string concatenation instead of parameterized queries allowed complete authentication bypass and full database extraction — one of the most exploited vulnerabilities in real-world penetration testing.

A PHP file inclusion pattern with zero input validation allowed an attacker to read arbitrary files from the server filesystem — including sensitive configuration files and system credentials.

During a lab exercise I landed a shell as www-data. A quick SUID enumeration revealed php7.4 with the SUID bit set. Here's how I went from a low-privilege web shell to full root access.

What started as a weird error message in a file download API turned into reading /etc/passwd off a production server. Here's the full story.

During a network pentest I found port 9100 open on an internal host. Turned out to be an HP LaserJet MFP. Here's how I enumerated it using raw PJL commands and what it exposed.

A custom deep merge utility passed user-controlled input directly into object property assignment — allowing an attacker to pollute JavaScript's Object prototype and escalate to remote code execution.

An Import/Export feature accepting XML files led to a Java deserialization vulnerability. By crafting a malicious XML payload using ProcessBuilder, I achieved remote code execution as NT AUTHORITY\SYSTEM.

A product search endpoint that accepted XML input had no entity processing restrictions. By injecting a malicious external entity, I read internal server files on both Linux and Windows targets.

An administrative console exposed a TCL script execution interface with no input sanitization. What was designed for internal diagnostics became a direct path to remote code execution as NT AUTHORITY\SYSTEM.