Published index

Blog Archive

Every published cybersecurity article, lab note, and technical writeup in one crawlable archive.

203
Entries
8
Years

2026

1 entries
  1. Running ComfyUI on AMD GPUs with ROCm (Pop!_OS / Ubuntu)

2025

15 entries
  1. SQL injection with filter bypass via XML encoding
  2. DOM XSS in jQuery anchor href attribute sink using location.search source
  3. Blind SQL injection with out-of-band data exfiltration
  4. Blind SQL injection with out-of-band interaction
  5. Blind SQL injection with time delays and information retrieval
  6. DOM XSS in innerHTML sink using source location.search
  7. Reflected XSS into HTML context with nothing encoded
  8. Stored XSS into HTML context with nothing encoded
  9. Deep dive: TCP, subnets, and Active Directory — the fundamentals a penetration tester must master
  10. Built a Microsoft 365 Email Viewer for my company
  11. Improvements during execution of my bug bounty framework
  12. A Busy Week Away from Pentesting and building
  13. Create a supported SFTP plugin for shutter
  14. Blind SQL injection with time delays
  15. WebSocket messages to exploit vulnerabilities

2024

1 entries
  1. Android HTTPS Interception with Genymotion + Burp – Walkthrough

2023

20 entries
  1. Username enumeration via response timing
  2. Insecure Direct Object References
  3. Recon Quick Hits — knockpy, ffuf, amass
  4. Made Dreambooth and GPT4-client run on Kali Linux
  5. AI - Stable diffussion with dreambooth
  6. User ID controlled by param with password disclosure
  7. URL-based access control can be circumvented
  8. User ID controlled by request parameter with data leakage in redirect
  9. User ID controlled by request parameter, with unpredictable user IDs
  10. User role can be modified in user profile
  11. Unprotected Admin Functionality with Unpredictable URL
  12. User role controlled by request parameter
  13. Knowledge article about Access-control
  14. Unprotected admin functionality
  15. Python script to extract recursive folders
  16. Bounty Hunt Steps
  17. Started the journey on BugBounty
  18. What is Cross-site-scripting and how does it work?
  19. How does SQL Injection work also when does it occur?
  20. What is CORS and how does it work?

2022

132 entries
  1. DOM XSS using web messages and a JavaScript URL
  2. Knowledge about DOM-based and sinks
  3. More knowledge about DOM
  4. WebListeners
  5. DOM XSS using web messages and a JavaScript URL
  6. CSRF with broken Referer validation
  7. CSRF where Referer validation depends on header being present
  8. CSRF where token is duplicated in cookie
  9. Learn about Sinks
  10. Knowledge about DOM-based stuff
  11. CSRF where token is tied to non-session cookie
  12. CSRF where token is duplicated in cookie
  13. CSRF where token is not tied to user session
  14. CSRF where token validation depends on request method
  15. CSRF vulnerability with no defenses
  16. CSRF where token validation depends on token being present
  17. Basic clickjacking with CSRF token protection
  18. Exploiting clickjacking vulnerability to trigger DOM-based XSS
  19. Clickjacking with form input data prefilled from a URL parameter
  20. Basic clickjacking with CSRF token protection
  21. Clickjacking with a frame buster script
  22. Exploiting XXE via image file upload
  23. Exploiting XXE to retrieve data by repurposing a local DTD
  24. Exploiting XInclude to retrieve files
  25. Exploiting blind XXE to retrieve data via error messages
  26. SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
  27. Exploiting blind XXE to exfiltrate data using a malicious external DTD
  28. Blind XXE with out-of-band interaction via XML parameter entities
  29. Blind XXE with out-of-band interaction
  30. Exploiting XXE to perform SSRF attacks
  31. What is XML and XXE and how does it work?
  32. Blind SQL injection with conditional responses Part#1
  33. Blind SQL injection with conditional responses part 2
  34. SQL injection attack, listing the database contents on Oracle
  35. SQL injection UNION attack, retrieving multiple values in a single column
  36. SQL injection vulnerability allowing login bypass
  37. SQL injection attack, listing the database contents on non-Oracle databases
  38. SQL injection UNION attack, determining the number of columns returned by the query
  39. SQL injection attack, querying the database type and version on Oracle
  40. HTB Academy - Web Enumeration
  41. HTB Academy - Get started
  42. HTB Academy Firewall and IDS/IPS Evasion - Medium Lab
  43. HTB Academy - Firewall and IDS/IPS Evasion - Hard Lab
  44. HTB Academy Firewall and IDS/IPS Evasion - Easy Lab
  45. HTB Academy - nmap scanning basics
  46. HTB Academy nmap network performance
  47. HTB Academy - NSE Scripts
  48. HTB Academy - Service Enumeration
  49. DOM XSS in jQuery anchor href attribute sink using location.search source
  50. What is httpOnly and how does it work?
  51. Same-orgin policy (SOP)
  52. DOM XSS sink using location.search
  53. How does sinks working with dom-based xss
  54. Stored XSS into HTML context with nothing encoded
  55. What is cross-site scripting and how does it work?
  56. Insecure direct object references
  57. HTB Academy - Create user
  58. HTB Academy - Active Direcotry
  59. HTB Academy - NTLM
  60. HTB Academy - Host Discovery nmap
  61. HTB Academy - Deobfuscation , Encode and decode
  62. HTB Academy - DNS
  63. HTB Academy Kerberos
  64. HTB Academy - LDAP
  65. HTB Academy - Curl
  66. HTB Academy - Web Requests
  67. HTB Academy broken web results challange #1
  68. HTB Academy Basic Auth challange
  69. HTB Academy broken API:s challange #3
  70. HTB Academy - Active Directory
  71. HTB Academy OSI-Model and Protocol breakdown
  72. HTB Academy Networking Primer - Layers 1-4
  73. HTB Academy - Wireshark #2
  74. HTB Academy - Network Wireshark and extract
  75. HTB Academy - Mac adddresses
  76. HTB Academy IP-protocols
  77. HTB Academy TCP-dump
  78. HTB Academy - Traffic analysis
  79. HTB Academy - The Analysis Process
  80. HTB Academy - Networking TCP/IP
  81. HTB Academy - Networking TCP/IP
  82. HTB Academy - Networking modules
  83. HTB Academy - Networking Proxies
  84. HTB Academy - Networking Topologies
  85. HTB Academy - Introduction to networking - overview
  86. DOM XSS in innerHTML sink using source location.search
  87. HTb Academy - Network Types
  88. CSRF where token is duplicated in cookie
  89. HTB Academy - Windows Sessions and Subsystem
  90. HTB Academy - Windows Services & Processes
  91. HTB Academy - File System
  92. HTB Academy - Operating System Structure
  93. HTB Academy - System Information
  94. HTB Academy - History and dir paths
  95. HTB Academy - Fundamentals - File Descriptors and Redirections
  96. HTB Academy - Fundamentals - Find Files and Directories
  97. HTB Academy - Filter Contents
  98. HTB Academy - Linux Security
  99. HTB Academy - Permission Management Quick Notes
  100. Reflected XSS into HTML context with most tags and attributes blocked
  101. Learn about Reflected XSS
  102. DOM XSS in document.write sink using source
  103. Stored XSS into HTML context with nothing encoded
  104. Reflected XSS into HTML context with nothing encoded
  105. Blind SQL injection with out-of-band data exfiltration rewritten
  106. Blind SQL injection with out-of-band interaction
  107. SQL injection with filter bypass via XML encoding
  108. Blind SQL injection with out-of-band data exfiltration
  109. SQL injection UNION attack, finding a column containing text
  110. SQL injection UNION attack, retrieving multiple values in a single column
  111. Blind SQL injection with conditional responses
  112. SQL injection vulnerability allowing login bypass
  113. SQL injection attack, querying the database type and version on MySQL and Microsoft
  114. Blind SQL injection with conditional errors
  115. SQL injection attack, listing the database contents on Oracle
  116. SQL injection UNION attack, retrieving data from other tables
  117. SQL injection UNION attack, determining the number of columns returned by the query
  118. Blind SQL injection with time delays
  119. Blind SQL injection with conditional responses Part#2
  120. CSRF - where token is tied to non-session cookie
  121. CSRF- Where Referer validation depends on header being present
  122. CSRF - where token is not tied to user session
  123. CSRF where token validation depends on token being present
  124. CSRF vulnerability with no defenses
  125. CSRF where token validation depends on request method
  126. Immerse myself within Python
  127. 2FA Broken Logic
  128. Pandora [Hack the box] - [Blog]
  129. Paper [Hack the box] [BLOG]
  130. [Red Team] Sektor 7 PE (Portable Executable)
  131. [SQL Injection] Module 1
  132. [Mutillidae] DOM XSS etc.

2021

7 entries
  1. Bruteforce | Owasp Top 10
  2. Broken Authentication TryHackMe | Owasp Top 10 [Dragable & Resizeable ]
  3. Command Injection Part 2 TryHackMe | Owasp Top 10
  4. Command Injection Part 1 TryHackMe | Owasp Top 10
  5. Hack The Box - Help
  6. Hack The Box Explore user-flag
  7. Hack The Box - CAP root flag

2020

4 entries
  1. Reported my first Bug Bounty finding
  2. Hack The Box Wall User and Root flag
  3. Hack The Box - Luke User and Root flag
  4. Hack The Box - Calamity user flag

2019

23 entries
  1. Hack The Box - Bank Root Flag
  2. Hack The Box - Bank user flag
  3. Hack The Box - Europa Part 2
  4. Hack The Box - Europa Part 1
  5. Hack The Box - Haircut Part 1
  6. Hack The Box - Sneaky
  7. Hack The Box - October Part 2
  8. Finally back hopefully! also made some improvements on xsisec.com
  9. Hack The Box - Apocalyst
  10. Hack The Box blue
  11. Hack The Box - Grandpa
  12. Hack The Box - Joker
  13. Hack The Box Tentan
  14. Hack The Box - Brainfuck
  15. BURP-Suite procedure for enumeration nested directories
  16. Hack The Box Beep
  17. another lesson of VIM
  18. Hack The Box - Optimum User Flag
  19. Spent some time to learn Protractor and some cool plugins
  20. Hack The Box - cronOS Complete
  21. Hack The Box Popcorn
  22. Hack The Box - Lame user and root
  23. Finally done with this project.