ArticleA Busy Week Away from Pentesting and building
Work took over this week with a full company website rewrite. From design to content, meetings and coding left no time for pentesting — but I’ll be b…
Knowledge base
Blog
Practical security research, write-ups, guides, and lessons learned.
- 199
- Entries
Explore
Blog Posts
Article
ArticleCreate a supported SFTP plugin for shutter
Step by step guide to install Shutter on Ubuntu 24.04, enable annotations, and configure SFTP uploads to your own server for instant, shareable scree…
ArticleBlind SQL injection with time delays
Exploited a blind SQL injection in a tracking cookie using time based payloads. Confirmed vulnerability by triggering measurable delays and identifyi…
ArticleWebSocket messages to exploit vulnerabilities
WebSocket messages to exploit vulnerabilities: Intercept and analyze WebSocket messages exchanged by the live chat to observe sensitive data in trans…
ArticleAndroid HTTPS Interception with Genymotion + Burp – Walkthrough
Android HTTPS Interception with Genymotion + Burp – Walkthrough: Set up a Genymotion Android VM to intercept and inspect HTTPS traffic from apps usin…
ArticleUsername enumeration via response timing
Username enumeration via response timing: Validate and detect SQL injection by leveraging time based behavior in a back‑end web service. • PortSwigge…
ArticleInsecure Direct Object References
Insecure Direct Object References: Identify and exploit an Insecure Direct Object Reference (IDOR) that exposes other users’ chat logs. • PortSwigger…
ArticleRecon Quick Hits — knockpy, ffuf, amass
Recon Quick Hits — knockpy, ffuf, amass: I wanted a tiny, repeatable snippet for quick reconnaissance. These are the three commands I keep coming bac…
ArticleMade Dreambooth and GPT4-client run on Kali Linux
Made Dreambooth and GPT4 client run on Kali Linux: After some time away, I hopped back to Kali Linux and finally got DreamBooth to run cleanly. Posti…
ArticleAI - Stable diffussion with dreambooth
AI Stable diffussion with dreambooth: CUDA 11.8 on Xubuntu (GCC 12) — My DreamBooth Prep Notes • Knowledge • cuda, dreambooth
ArticleUser ID controlled by param with password disclosure
User ID controlled by param with password disclosure: This lab’s account page prefilled the current user’s password in a masked input. The goal was t…
ArticleURL-based access control can be circumvented
URL based access control can be circumvented: This lab uses a front end system to block access to /admin, but the back end supports the X Original UR…