Hello, World!
RSS FeedApplication security notes, penetration-testing writeups, and practical research covering web, mobile, API, and system security.
Read the latest posts, explore the Directory , or visit my portfolio .
Featured
Explore how Android security really works under the hood.
Step-by-step HackTheBox Fluffy walkthrough covering SMB enumeration, File Explorer NTLM capture, BloodHound mapping, ADCS shadow-credential abuse, and domain administrator escalation.
Recent Posts
Configure Burp Suite proxy on rooted Android with Magisk's AlwaysTrustUserCerts. Includes certificate conversion (DER→PEM) and install.
Dependency confusion exploits a critical supply chain loophole. Learn how attackers hijack package names and compromise projects through misconfigurations.
HTB Caption walkthrough: Exploit GitBucket default creds, abuse H2 DB for RCE, and escalate to root using a Thrift log parser vulnerability.
In this write-up, we walk through the CICADA box on HTB from user enumeration and credential stuffing to full domain compromise using SeBackupPrivilege.