PENETRATION TESTER // OFFENSIVE SECURITY // WEB APP SECURITY // RED TEAM OPS // NETWORK SECURITY // EXPLOIT DEVELOPMENT // PENETRATION TESTER // OFFENSIVE SECURITY // WEB APP SECURITY // RED TEAM OPS // NETWORK SECURITY // EXPLOIT DEVELOPMENT //

03 — KNOWLEDGE BASE

BLOG & WRITEUPS

$ sqlmap -u "target/login" --dbs
available databases:
[+] information_schema
[+] production_db
$ dump --table users
[+] 4821 entries extracted
Web App 2026-01-15 8 MIN READ
SQL Injection to Full Database Compromise
A walkthrough of a real-world engagement where a seemingly minor SQLi vulnerability led to complete database exfiltration and lateral movement.
READ MORE
 
$ GetUserSPNs.py corp/user
ServicePrincipalName: HTTP/app
$ hashcat -m 13100 hash.txt
[+] P@ssw0rd123 CRACKED
$ psexec.py admin@dc01
Active Directory 2025-12-03 12 MIN READ
AD Privilege Escalation via Kerberoasting
How I escalated from a low-privilege domain user to Domain Admin in under 4 hours using Kerberoasting and misconfigured service accounts.
READ MORE
 
$ python3 exploit.py --target htb
[*] Sending payload...
[*] WAF bypass: SUCCESS
$ nc -lvnp 4444
[+] Connection received
[+] whoami: root
CTF Writeup 2025-10-22 10 MIN READ
HackTheBox — Machine Writeup: Fortress
Full walkthrough of the Fortress machine — initial foothold through API key leakage, privilege escalation via SUID binary exploitation.
READ MORE
 
$ nmap -sV --script vuln 10.0.0.0/24
[*] Scanning 254 hosts...
[+] 10.0.0.12: EternalBlue
[+] 10.0.0.47: MS17-010
$ use exploit/ms17_010_eternalblue
Network 2025-09-11 9 MIN READ
Internal Network Assessment: From Zero to Domain
Internal pentest methodology from initial reconnaissance to full domain compromise, including legacy system exploitation and credential harvesting.
READ MORE
 
$ burpsuite --intercept on
[*] Analyzing JWT tokens...
alg: none [VULNERABLE]
$ forge-token --alg none --role admin
[+] Access granted: admin panel
Research 2025-07-30 15 MIN READ
JWT Algorithm Confusion Attacks in the Wild
Deep dive into JWT vulnerabilities found across multiple bug bounty targets — algorithm confusion, weak secrets, and the "none" algorithm bypass.
READ MORE
 
$ ffuf -w wordlist -u /FUZZ
[+] /.git/config  [200]
[+] /api/v1/admin [403]
$ gitdumper.sh target/.git
[+] Source code recovered
Web App 2025-06-14 7 MIN READ
Exposed .git Directory to Source Code Theft
How a misconfigured web server exposing a .git directory led to full source code exfiltration and discovery of hardcoded credentials.
READ MORE