Application security notes, penetration-testing writeups, and practical security research.https://notes.amalpk.in/https://notes.amalpk.in/posts/introduction-to-android-security/https://notes.amalpk.in/posts/introduction-to-android-security/Explore how Android security really works under the hood.Fri, 05 Jun 2026 05:53:53 GMThttps://notes.amalpk.in/posts/hackthebox-fluffy-walkthrough-windows-seasonal-box/https://notes.amalpk.in/posts/hackthebox-fluffy-walkthrough-windows-seasonal-box/Step-by-step HackTheBox Fluffy walkthrough covering SMB enumeration, File Explorer NTLM capture, BloodHound mapping, ADCS shadow-credential abuse, and domain administrator escalation.Fri, 08 May 2026 06:31:18 GMThttps://notes.amalpk.in/posts/android-burp-proxy-setup/https://notes.amalpk.in/posts/android-burp-proxy-setup/Configure Burp Suite proxy on rooted Android with Magisk's AlwaysTrustUserCerts. Includes certificate conversion (DER→PEM) and install.Fri, 08 May 2026 06:22:04 GMThttps://notes.amalpk.in/posts/dependency-confusion/https://notes.amalpk.in/posts/dependency-confusion/Dependency confusion exploits a critical supply chain loophole. Learn how attackers hijack package names and compromise projects through misconfigurations.Tue, 11 Nov 2025 05:23:01 GMThttps://notes.amalpk.in/posts/caption-hackthebox-writeup/https://notes.amalpk.in/posts/caption-hackthebox-writeup/HTB Caption walkthrough: Exploit GitBucket default creds, abuse H2 DB for RCE, and escalate to root using a Thrift log parser vulnerability.Mon, 07 Jul 2025 07:46:11 GMThttps://notes.amalpk.in/posts/cicada-hackthebox-writeup/https://notes.amalpk.in/posts/cicada-hackthebox-writeup/In this write-up, we walk through the CICADA box on HTB from user enumeration and credential stuffing to full domain compromise using SeBackupPrivilege.Mon, 07 Jul 2025 05:07:27 GMThttps://notes.amalpk.in/posts/host-header-injection/https://notes.amalpk.in/posts/host-header-injection/Discover how Host Header Injection works, its risks, real-world attack examples, and steps to secure your web applications from this hidden threat.Fri, 04 Jul 2025 12:29:54 GMThttps://notes.amalpk.in/posts/nosql-injection/https://notes.amalpk.in/posts/nosql-injection/NoSQL injection is a vulnerability where an attacker is able to interfere with the queries that an application makes to a NoSQL databaseThu, 01 May 2025 15:05:03 GMThttps://notes.amalpk.in/posts/understanding-crlf-injection-and-its-exploitation-b8271d14452a/https://notes.amalpk.in/posts/understanding-crlf-injection-and-its-exploitation-b8271d14452a/CRLF (Carriage Return Line Feed) injection is a type of attack that targets web applications through the manipulation of HTTP headers.Tue, 11 Feb 2025 18:30:00 GMThttps://notes.amalpk.in/posts/web-cache-deception/https://notes.amalpk.in/posts/web-cache-deception/Web caching is a technique used to store copies of web pages, images, and other resources to improve performance and reduce server loadWed, 29 Jan 2025 18:30:00 GMThttps://notes.amalpk.in/posts/unrested-htb/https://notes.amalpk.in/posts/unrested-htb/Unrested is a medium difficulty Linux machine on Hackthebox (HTB) platform hosting a version of ZabbixTue, 28 Jan 2025 18:30:00 GMThttps://notes.amalpk.in/posts/cve-2025-21298/https://notes.amalpk.in/posts/cve-2025-21298/CVE-2025-21298 is a critical OLE vulnerability in Windows that enables remote code execution with a CVSS score of 9.8 on Windows 10, 11, and Server 2008–2025.Sun, 26 Jan 2025 18:30:00 GMT