Archives
All the articles I've archived.
Explore how Android security really works under the hood.
Step-by-step HackTheBox Fluffy walkthrough covering SMB enumeration, File Explorer NTLM capture, BloodHound mapping, ADCS shadow-credential abuse, and domain administrator escalation.
Configure Burp Suite proxy on rooted Android with Magisk's AlwaysTrustUserCerts. Includes certificate conversion (DER→PEM) and install.
Dependency confusion exploits a critical supply chain loophole. Learn how attackers hijack package names and compromise projects through misconfigurations.
HTB Caption walkthrough: Exploit GitBucket default creds, abuse H2 DB for RCE, and escalate to root using a Thrift log parser vulnerability.
In this write-up, we walk through the CICADA box on HTB from user enumeration and credential stuffing to full domain compromise using SeBackupPrivilege.
Discover how Host Header Injection works, its risks, real-world attack examples, and steps to secure your web applications from this hidden threat.
NoSQL injection is a vulnerability where an attacker is able to interfere with the queries that an application makes to a NoSQL database
CRLF (Carriage Return Line Feed) injection is a type of attack that targets web applications through the manipulation of HTTP headers.
Web caching is a technique used to store copies of web pages, images, and other resources to improve performance and reduce server load
Unrested is a medium difficulty Linux machine on Hackthebox (HTB) platform hosting a version of Zabbix
CVE-2025-21298 is a critical OLE vulnerability in Windows that enables remote code execution with a CVSS score of 9.8 on Windows 10, 11, and Server 2008–2025.