// A blog about cybersecurity and penetration testing
Latest post
all posts →Highscore: Sequelize WHERE Clause Injection
Exploiting unsafe JSON construction and Sequelize query handling to bypass session validation
More posts
StreamCore: Chaining a JWT kid Path Traversal with Streamlink LFI
A writeup of YesWeHack's Dojo 52 challenge, StreamCore. A single unsanitized JWT header field lets you forge an admin token, then smuggle a local file read through Streamlink's HLS resolver.
HTB CWES: My Exam Experience and What I'd Tell a Friend
What the HackTheBox Certified Web Exploitation Specialist exam is actually like, how I prepped for it.
HTB: Manage Walkthrough
A walkthrough of HTB's Manage: exploiting an exposed JMX service over Java RMI, digging an SSH key and a TOTP seed out of a backup to get past 2FA, then escalating to root through a sudoers rule that lets you create an admin user who quietly inherits full sudo rights via Ubuntu's default %admin group.
Always Has Been: Crypto Challenge Writeup
A detailed writeup of HackTheBox's Always Has Been crypto challenge: analyzing a custom block-cipher-based hash function, reducing it to an affine system, and solving for the original input to recover the flag.